feat: add gmc ordertracking (order tracking signals)

[yasserstudio]

Summary

Adds gmc ordertracking — the Order Tracking sub-API (ordertracking/v1, accounts.orderTrackingSignals). This was the last remaining GA (v1) Merchant API sub-API, so the stable v1 surface is now fully covered (12 sub-APIs).

Order tracking signals report completed shipments so Google can show accurate delivery estimates. The sub-API is write-only — there is no get/list/update/delete, and a signal is immutable once created.

gmc ordertracking create --file signal.json
cat signal.json | gmc ordertracking create        # or via stdin
gmc ordertracking create --file signal.json --merchant-id 555

Changes

• api — OrderTrackingService + typed OrderTrackingSignal / ShippingInfo / LineItemDetails / ShipmentLineItemMapping shapes; registers the ordertracking sub-API (union + rate-limit bucket).
• cli — ordertracking create: reads the signal from --file/stdin, validates the required fields (orderId, non-empty shippingInfo, non-empty lineItems) offline by shape (an object-instead-of-array or a blank id fails fast, not as an opaque 400), strips the output-only orderTrackingSignalId, and supports --merchant-id.
• auth — maps ordertracking to the content scope (mirrors every sibling sub-API).
• docs — new reference page; roadmap/index updated to "12 GA sub-APIs — v1 surface complete". reviews / productstudio / youtube remain pre-GA and are deferred until they graduate to v1.

Contract accuracy

The wire shape was verified against the google/shopping/merchant/ordertracking/v1 proto: POST /ordertracking/v1/{parent=accounts/*}/orderTrackingSignals with the signal as the request body — no dataSource (unlike products/promotions). The API test asserts the exact URL and verbatim body to guard against field drift.

Testing

• Full suite green: api 155, cli 304 (+9 new), auth 31, migrate 60.
• Typecheck / lint / prettier clean.
• Live smoke test of the built binary: offline validation → exit 2; a valid body reaches the API.

Release

Changeset included: @gmc-cli/cli → 1.0.16, @gmc-cli/api → 0.9.21, @gmc-cli/auth → 0.7.3 (all patch, per the post-1.0 patch-per-deliverable cadence).