Authing the Shopify CLI to operate a store, expanding OAuth scopes mid-project, and avoiding the permanent-vs-custom-domain trap.