add order status lookup for customers

Magic link flow on contact page: customer enters email, gets a
time-limited signed link, clicks through to /orders showing all their
paid orders and full detail pages with thumbnails and product links.

- OrderLookupController generates/verifies Phoenix.Token signed links
- Contact LiveView handles lookup_orders + reset_tracking events
- Orders and OrderDetail LiveViews gated by session email
- Order detail shows thumbnails, links to products still available
- .themed-button gets base padding/font-weight so all usages are consistent
- order-summary-card sticky scoped to .cart-grid (was leaking to orders list)
- 27 new tests (1095 total)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/berrypod_web/controllers/order_lookup_controller.ex

@@ -0,0 +1,32 @@
+defmodule BerrypodWeb.OrderLookupController do
+  use BerrypodWeb, :controller
+
+  @salt "order_lookup"
+  @max_age 3_600
+
+  def verify(conn, %{"token" => token}) do
+    case Phoenix.Token.verify(BerrypodWeb.Endpoint, @salt, token, max_age: @max_age) do
+      {:ok, email} ->
+        conn
+        |> put_session(:order_lookup_email, email)
+        |> redirect(to: ~p"/orders")
+
+      {:error, :expired} ->
+        conn
+        |> put_flash(:error, "That link has expired. Please request a new one.")
+        |> redirect(to: ~p"/contact")
+
+      {:error, _} ->
+        conn
+        |> put_flash(:error, "That link is invalid.")
+        |> redirect(to: ~p"/contact")
+    end
+  end
+
+  @doc """
+  Generates a signed, time-limited token for the given email address.
+  """
+  def generate_token(email) do
+    Phoenix.Token.sign(BerrypodWeb.Endpoint, @salt, email)
+  end
+end