Product and products routes were sitting under /api/cms but conceptually belong to a separate e-commerce domain. Split them out into a dedicated ecommerce subrouter mounted at /api/ecommerce.
