Build sales reports you can trust, with CSV export

You are a careful senior full-stack engineer working inside my project folder. The store is "Thread & Needle", a fashion e-commerce store selling women's and men's clothing, shoes and accessories in United States, charging in USD. Build a reports area in the admin panel so I can understand sales without exporting everything into a spreadsheet. I am not a programmer, so explain any technical word in a few words.

Plan first: look at the orders, order items, refunds, stock and customers tables, then show me your plan (which report answers which question, and the exact rule for what counts as a sale) and wait for my OK before changing anything.

Rules for the numbers (write them at the top of the reports page in plain words):
- A sale counts only when the order is paid. Cancelled and unpaid orders are excluded.
- Refunds are subtracted on the day they happen, so net sales = paid amounts minus refunds.
- All money is stored and calculated in the smallest unit of USD (for example cents) and shown with proper formatting. No floating point money maths.
- Days, weeks and months use the store time zone that I will tell you, not the server's.

Tasks:
1. A date-range control with presets (today, last 7 days, last 30 days, this month, last month, custom). The range is stored in the page address so a report can be bookmarked. Validate it with Zod and cap the maximum range.
2. Sales report: orders, gross sales, refunds, net sales, shipping and tax collected, with a daily, weekly or monthly toggle, shown as a simple chart and a table. Use lightweight charts made with plain SVG or CSS; do not add a heavy chart library or any third-party tracking script.
3. Top products: best sellers by units and by revenue for the range, with the share of total.
4. Average order value and orders per customer, compared with the previous period of the same length.
5. Low stock report: products at or below their threshold, with days of stock left based on recent sales, where there is enough data.
6. Customer growth: new accounts per period and the share of orders from returning customers. Show counts only, not names.
7. CSV export on each report. Export aggregated rows only by default. Protect against spreadsheet formula injection by prefixing any cell that starts with =, +, - or @ with a single quote. Use UTF-8 and put the date range in the file name.
8. Do the grouping in SQL with indexes where needed, so reports stay fast with thousands of orders. Add a short cache of a few minutes only if it is clearly needed.

Security and privacy rules:
- Reports are admin only, checked on the server for the page and for every export route.
- Reports must not show customer emails, names or addresses. If I later want a customer-level export, it must be a separate, clearly labelled button that asks for confirmation.
- Never print, log or commit secrets or personal data.

Verify: add unit tests for the sale rule, refund subtraction and rounding, and for the CSV escaping. Compare each report total with a direct count in the local shop_local database and show me both numbers side by side. Run type-check, lint, tests and a production build.

Commit on a feature branch with a clear message.

Report back in this format: 1) What was done. 2) What I should check myself. 3) Anything that needs my decision.

Review the prompt, then copy it. Never paste real passwords or API keys into a chat.