Fix Woo sync: exempt webhooks from CSRF and backfill on connect.

Auto-import catalog and orders after store activation, add manual order sync, and allow WooCommerce webhooks without CSRF tokens.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Woo/OrderController.php

@@ -6,6 +6,7 @@ use App\Http\Controllers\Controller;
 use App\Models\WooOrder;
 use App\Models\WooStore;
 use App\Services\Woo\FulfillmentSyncService;
+use App\Services\Woo\OrderSyncService;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Validation\Rule;
@@ -13,7 +14,10 @@ use Illuminate\View\View;
 
 class OrderController extends Controller
 {
-    public function __construct(private FulfillmentSyncService $sync) {}
+    public function __construct(
+        private FulfillmentSyncService $sync,
+        private OrderSyncService $orderSync,
+    ) {}
 
     public function index(Request $request): View
     {
@@ -58,4 +62,25 @@ class OrderController extends Controller
 
         return back()->with('success', 'Fulfillment status updated.');
     }
+
+    public function sync(Request $request): RedirectResponse
+    {
+        $validated = $request->validate([
+            'store' => ['required', 'integer'],
+        ]);
+
+        $store = WooStore::query()
+            ->where('user_id', $request->user()->id)
+            ->whereKey((int) $validated['store'])
+            ->where('status', WooStore::STATUS_ACTIVE)
+            ->firstOrFail();
+
+        $count = $this->orderSync->syncOrders($store);
+
+        return back()->with('success', sprintf(
+            'Synced %d orders from %s.',
+            $count,
+            $store->site_name ?? $store->site_url,
+        ));
+    }
 }