Provision a store

Adds a store to the network directory. This is an ONBOARDING operation, not an everyday one: the created store immediately becomes addressable for pricing, inventory, transfers and register pairing, so only call it when the task is explicitly about opening a location. The id is caller-supplied — pick a stable, URL-safe slug (e.g. store-pilot), because it is the handle every other operation will use forever; 409s when a store already carries it (creating is never an overwrite — use the update operation instead). active is optional and defaults to true, so a store you provision is trading immediately unless you pass active:false. PERMISSION TRAP (see solya-pos#950): the route guard accepts pos.settings.manage, but the use-case additionally asserts the kernel config:manage permission and NO pos.settings.* scope maps to it, so a principal authenticated by scopes alone clears the guard and then 403s inside the use-case — only a session whose role carries config:manage can actually create.