Ensure Installed

Exchange session token for offline access token on first load.

Managed installation bypasses /install and /callback — Shopify handles consent itself and loads application_url directly in the iframe. This endpoint detects the missing store record and exchanges the session token (JWT) for a non-expiring offline access token via Shopify's token exchange API.

Idempotent: returns immediately if store record already exists.