Add shop, POS sync, event ticketing, and shipping catalog apps (#6)

## Summary
- Closes #5
- Optional `shop`, `pos_sync`, `events`, and `shipping` apps gated by `FEATURE_*` flags
- Deps match the catalog: shop/events need email + Stripe; POS/shipping need shop
- Portal inventory, POS webhooks, capacity tickets, EasyPost/Pirate Ship shipping

## Test plan
- [ ] `manage.py test` (152 passed locally)
- [ ] Shop cart + paid order decrements stocked inventory
- [ ] POS inbound webhook decrements SKU; paid order queues outbound reserve
- [ ] Event capacity blocks overbook; paid order emails ticket codes
- [ ] Shipping stub label + Pirate Ship CSV of unshipped paid orders
- [ ] `validate-env.sh` rejects shop without email/payments, POS/shipping without shop

Reviewed-on: #6

site/shipping/models.py

@@ -0,0 +1,33 @@
+from django.db import models
+
+from core.models import TimeStampedModel, UUIDPrimaryKeyModel
+from shop.models import Order
+
+
+class Shipment(UUIDPrimaryKeyModel, TimeStampedModel):
+    class Status(models.TextChoices):
+        DRAFT = "draft", "Draft"
+        RATED = "rated", "Rated"
+        LABELED = "labeled", "Labeled"
+        VOID = "void", "Void"
+
+    order = models.ForeignKey(Order, on_delete=models.PROTECT, related_name="shipments")
+    status = models.CharField(
+        max_length=16, choices=Status.choices, default=Status.DRAFT
+    )
+    carrier = models.CharField(max_length=32, blank=True)
+    service = models.CharField(max_length=64, blank=True)
+    tracking_number = models.CharField(max_length=64, blank=True)
+    label_url = models.URLField(blank=True)
+    rate_amount = models.DecimalField(max_digits=10, decimal_places=2, null=True, blank=True)
+    currency = models.CharField(max_length=8, default="usd")
+    provider_shipment_id = models.CharField(max_length=255, blank=True)
+    rates = models.JSONField(default=list, blank=True)
+    weight_oz = models.PositiveIntegerField(default=16)
+    notes = models.TextField(blank=True)
+
+    class Meta:
+        ordering = ["-created_at"]
+
+    def __str__(self) -> str:
+        return f"{self.order.number} · {self.tracking_number or self.status}"