implement shopify app oauth install flow and session tokens for embedded apps

This API has logged drift

In-depth guide

Steps

1. Begin the OAuth flow by redirecting the merchant to Shopify's authorization endpoint with parameters: `client_id`, `scope`, `redirect_uri`, and a cryptographically random `state` value stored in a cookie or session.
2. Shopify redirects back to your `redirect_uri` with a `code` and `shop` parameter; validate that `state` matches, that `shop` ends in `.myshopify.com`, and verify the `hmac` parameter by recomputing it over the sorted query parameters using your client secret.
3. Exchange the `code` for an access token by POSTing to `https://{shop}/admin/oauth/access_token` with `client_id`, `client_secret`, and `code`; store the returned `access_token` securely associated with the shop.
4. For embedded apps using Shopify App Bridge, retrieve session tokens from App Bridge's `getSessionToken()` method (a signed JWT) and send them to your backend on each request instead of relying on cookies.
5. On your backend, verify the session token JWT signature using your app's client secret and validate the `iss`, `dest`, `aud`, and `exp` claims.
6. Use online tokens (associated with a specific staff user) for embedded app requests and offline tokens (shop-level, long-lived) for background jobs and webhooks.