Harden token exchange shop context handling

[lizkenyon]

What this PR does

• Hardens token-exchange shop context handling.
• Separates requested and authenticated shop domain helpers.
• Aligns authenticated controller helpers with verified token/session context.
• Updates tests and related docs.

Reviewer's guide to testing

Validated locally with:

bundle exec ruby -Itest test/shopify_app/controller_concerns/token_exchange_test.rb
bundle exec ruby -Itest test/shopify_app/controller_concerns/login_protection_test.rb
bundle exec rake test
bundle exec rubocop lib/shopify_app/controller_concerns/token_exchange.rb test/shopify_app/controller_concerns/token_exchange_test.rb
git diff --check

Things to focus on

1. lib/shopify_app/controller_concerns/token_exchange.rb
2. Token-exchange helper and session-activation coverage
3. Docs/changelog wording

Checklist

• Update CHANGELOG.md if the changes would impact users
• Update README.md, if appropriate.
• Update any relevant pages in /docs, if necessary
• For security fixes, the Disclosure Policy must be followed.

[lizkenyon]

AI:

This split keeps requested shop context available for bootstrap and routing, while aligning authenticated helpers with verified token/session context.

[lizkenyon]

AI:

This keeps the added validation scoped to cases where both contexts are available, so existing missing/invalid token bounce and retry behavior remains unchanged.