B2.3: Menus, modifier groups, and availability windows

Part of #1.

• Product + Category scoped by businessId (menu sections via parentCategoryId + displayOrder)
• ModifierGroup (required/optional, minSelections/maxSelections) + Modifier (price delta in cents), attached to products
• Availability windows (breakfast menu, happy hour) on categories/products
• Merchant-gated CRUD actions; public menu read endpoint shaped for the business page
• Tests: modifier constraint validation, price math with deltas, window filtering

Done. Menus are Product + Category scoped by business, with ModifierGroup/Modifier giving the grammar ProductVariant's JSON blob could not express: min/max selections, signed price deltas, and defaults.

GET /api/businesses/{slug}/menu returns sections in kitchen order with every group's constraints, so the ordering screen can enforce them while somebody chooses. The server enforces them again at placement, because a client-side rule is a courtesy and not a check - a missing required choice, an option from another item and an unavailable one are all refused there.

Availability windows (breakfast menus, happy hour) are the one part of this issue not built.