Fix Woo sync: exempt webhooks from CSRF and backfill on connect.

Auto-import catalog and orders after store activation, add manual order sync, and allow WooCommerce webhooks without CSRF tokens.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Api/StoreActivationController.php

@@ -3,6 +3,7 @@
 namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
+use App\Jobs\StoreBootstrapSync;
 use App\Models\WooStore;
 use App\Services\Woo\InstallTokenService;
 use Illuminate\Http\JsonResponse;
@@ -37,6 +38,8 @@ class StoreActivationController extends Controller
         $pluginToken = $this->tokens->issuePluginToken($store);
         $store = $store->fresh();
 
+        StoreBootstrapSync::dispatch($store->id)->afterResponse();
+
         return response()->json([
             'store_id' => $store->public_id,
             'webhook_url' => $store->webhookUrl(),