Publish the app-hook contract and clean starter defaults

Problem: Spark has 10+ {% app_hook %} sites but no published contract, so an app developer must grep the theme to discover them. The public theme docs document only two global hooks. Separately, the public schema ships one merchant-specific metadata key as a default, and PLAN.md disagrees with the README on the Web Component count.

Evidence: hook sites across layouts/base.html, templates/catalogue/product.html, partials/product_card.html, templates/index.html; TODOS.md:26-31 (promote the hook list to a documented public contract); configs/settings_schema.json:827 and layouts/base.html:208 (merchant-specific default); PLAN.md:15 (five vs six components).

Done when:

• The hook inventory is published in Spark docs with naming conventions and a versioning policy.
• The membership metadata key default is neutral, with the old value documented as a migration note.
• PLAN.md matches the shipped component count.

Read the hook sites in layouts/base.html, templates/catalogue/product.html, partials/product_card.html, and templates/index.html, then compare them with TODOS.md:26-31 and the existing theme docs. Review configs/settings_schema.json:827, layouts/base.html:208, PLAN.md:15, and the README. Done means the hook contract, naming and versioning policy are published, the metadata default is neutral with a migration note, and the component count agrees.