Cart metafields: app-owned route + skill (stacked on #3967)

[andguy95]

Stacked on #3967 (cart refresh API). This PR is based on an-cart-refresh-util;

TL;DR: Cart metafields are server-only — the Storefront cart ajax API (Standard Actions) does not support them, so they can't flow through Hydrogen's optimistic cart store. Instead of teaching the core cart API about metafields, this demonstrates the composable pattern: read through a custom CartFragment, write through an app-owned route, and re-sync with refresh().

What this changes

• Adds an app-owned POST /api/cart/metafields route in the Hydrogen example. It runs cartMetafieldsSet for an existing cart, cartCreate (with the metafields) when no cart exists yet, and cartMetafieldDelete for a single key. It returns only the mutation userErrors — it never refetches and returns the cart.
• Reads the metafield back through a custom CartFragment on the cart server handlers.
• Adds a "Delivery instructions" section to CartSummary that writes via the route and calls useCartActions().refresh() on success. No component-local metafield state.
• Adds a standalone hydrogen-cart-metafields skill and cross-links it from hydrogen-cart-ui.
• Records the metafields doc dependencies in .docs/dependencies.md.

Why decouple the write from the read

The mutation route returns only userErrors; re-syncing is a separate refresh() call. This keeps a successful save from being reported as a "network error" when a later read blips — a failed re-sync surfaces as errors.network and preserves the saved cart, never as a failed save.

Developer impact

• Adds a packaged skill (hydrogen-cart-metafields) that ships in @shopify/hydrogen, plus a one-line cross-reference in hydrogen-cart-ui. No new exports or runtime APIs.
• A patch changeset is likely warranted for the packaged skill addition. Not included yet — flagging for a decision.
• Example app code does not ship.

UX impact

• New "Delivery instructions" control in the cart summary (save / remove). The saved value persists on the cart and re-syncs after saving.

Out of scope

• No cart metafield intents in the core cart action model (deliberate — metafields stay app-owned).
• Request-body validation is hand-rolled in the example route; Zod was not added to the example.
• Automated tests for the route are not included yet (the example has no unit-test harness) — pending a decision on approach.

How to Test

1. From the repo root: pnpm install, then pnpm --filter @shopify/hydrogen build.
2. pnpm --dir examples/hydrogen dev and open the printed local URL.
3. Add a product to the cart and open the cart. Find "Delivery instructions" in the summary (not you may have to add this metafield to your specific store).
4. Enter text and Save. Reopen the cart and confirm the value persists. Clear the text and save to remove it.