feat: Laravel 13 support + Shopify expiring offline tokens fix

[Haseeb9229]

• composer.json: add Laravel ^13.0 to framework version constraint
• ApiHelper: override getAccessData() to POST with expiring=1 so Shopify returns short-lived access_token (1hr) + refresh_token (90 days)
• ApiHelper: add refreshAccessToken() method to exchange refresh token
• ApiHelper contract: add refreshAccessToken() to IApiHelper interface
• InstallShop: persist refresh_token, token_expires_at and refresh_token_expires_at after OAuth completes
• Migration: add refresh_token, token_expires_at, refresh_token_expires_at columns to shops table (safe — checks hasColumn before adding)
• Trait RefreshesShopifyToken: ensureValidAccessToken() checks expiry, refreshes automatically with cache lock to prevent race conditions on concurrent jobs, resets apiHelper so next api() call uses fresh token; overrides api() so protection is transparent to all callers

Shopify deprecated non-expiring offline tokens in December 2025. This fix is backward compatible: shops with NULL token_expires_at (installed before this change) are treated as legacy and will continue working until Shopify rejects their old token, at which point they re-open the app and get fresh expiring tokens via OAuth.

[simone-boa-ideas]

Hi, there is a separate PR for adding support to Laravel 13 - which is still in a pending state.
I'm wondering if it makes sense to cover it as part of this PR too.
Won't it complicate life for the reviewing team, since you have a PR that introduces more than one feature?

[JonPurvis]

Yeah these 2 things are in separate PR's and although this PR updates composer.json to allow Laravel 13, it doesn't update the github workflow file. There are 2 releases planned:

• A minor release that adds the offline token stuff (Support expiring offline access tokens #471)
• A major release that drops support for old Laravel and PHP versions and adds support for L13 and PHP 8.5 (Drop Support for Older PHP & Laravel #475)