parity(docs): record D13 — retail storefront preserved but out of scope

The owner ruled that the reference also ran a retail storefront (B2C
single-customer shop) and that the wallet, cashback and
ConfigStatic['percent'] belong to it. These are preserved exactly as they
are: nothing deleted or disabled on either side, no parity work, listed in
the matrices with status "preserved — out of current scope" and no gap or
work row. Shared surfaces (product, variant, price, order, customer) need
the owner's approval before a change that could reach the storefront.

Classifying the endpoints for that split surfaced a counting error in the
Phase 0 inventory: routes/admin.php has 151 live explicit routes, not the
117 recorded, so the reference total is 412 and not 369 (logged DOC-01).
get-analytics-tak reads SingleCustomerOrders, so it is a storefront route
despite its neutral name (logged DOC-02).

Of the 412 reference endpoints, 109 are retail storefront, 15 are web.php
dev/ops closures, and 288 remain in scope (218 admin + 70 B2B app).

[ref: henza_server/routes/{admin,api,customer,site,web}.php]

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/parity/PROTECTED.md

@@ -235,3 +235,37 @@ it is a keep-out list.
 - Unverified OTP — D6
 - The public customer list — D8
 - `singleCustomer.vue`'s full-form send — D11
+
+---
+
+## H — Retail storefront (D13) — preserved, out of current scope
+
+Owner's ruling of 2026-09-22. The reference also ran a **retail storefront**
+(B2C single-customer shop). The **wallet**, **cashback** and
+`ConfigStatic['percent']` belong to it.
+
+**Keep-out rule — stronger than "protected":** these are neither fixed nor
+touched. Nothing is deleted or disabled on either side; no parity work is done
+on them; they appear in the matrices only with status **⏸️ حفظ‌شده — خارج از
+کار فعلی**, with no gap row and no work row.
+
+| Surface | Reference | Endpoints |
+|---|---|---|
+| Customer API (prefix `cu`) | `routes/customer.php` | 48 |
+| Public site API (prefix `site`) | `routes/site.php` | 30 |
+| Wallet / cashback admin | `admin.php:186-191`, `Adm\WalletController` | 6 |
+| Retail-customer admin | `admin.php:35,59,60,194-199` + `single` resource | 15 |
+| Retail analytics | `admin.php:38` `get-analytics-tak` → `SingleCustomerOrders` | 1 |
+| Product comments admin | `admin.php:150-152` + `comment` resource | 9 |
+| **Total** | | **109** |
+
+Whatever of this already exists in `gold-banking-monorepo` stays exactly as it
+is — it is not restyled, not refactored, not removed.
+
+**Shared-surface warning.** Product, variant, price, order and customer are
+shared between the B2B business and the storefront. Before changing any of
+them, check whether the change reaches the storefront and **ask the owner
+first** (D13 rule 4). When in doubt whether something is storefront-only or
+shared, **list it and ask — never guess** (D13 rule 5).
+
+Full reasoning and the endpoint classification: `DECISIONS.md` § D13.