add order status lookup for customers

Magic link flow on contact page: customer enters email, gets a
time-limited signed link, clicks through to /orders showing all their
paid orders and full detail pages with thumbnails and product links.

- OrderLookupController generates/verifies Phoenix.Token signed links
- Contact LiveView handles lookup_orders + reset_tracking events
- Orders and OrderDetail LiveViews gated by session email
- Order detail shows thumbnails, links to products still available
- .themed-button gets base padding/font-weight so all usages are consistent
- order-summary-card sticky scoped to .cart-grid (was leaking to orders list)
- 27 new tests (1095 total)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test/berrypod/orders/order_notifier_test.exs

@@ -93,6 +93,20 @@ defmodule Berrypod.Orders.OrderNotifierTest do
     end
   end
 
+  describe "deliver_order_lookup/2" do
+    test "sends magic link email" do
+      link = "https://example.com/orders/verify/tok"
+      assert {:ok, _email} = OrderNotifier.deliver_order_lookup("buyer@example.com", link)
+
+      assert_email_sent(fn email ->
+        assert email.to == [{"", "buyer@example.com"}]
+        assert email.subject == "Your order lookup link"
+        assert email.text_body =~ link
+        assert email.text_body =~ "expires in 1 hour"
+      end)
+    end
+  end
+
   describe "deliver_shipping_notification/1" do
     test "sends notification with tracking info" do
       {order, _v, _p, _c} = submitted_order_fixture(%{customer_email: "buyer@example.com"})

test/berrypod/orders_test.exs

@@ -1,6 +1,7 @@
 defmodule Berrypod.OrdersTest do
   use Berrypod.DataCase, async: false
 
+  import Ecto.Query
   import Mox
   import Berrypod.OrdersFixtures
 
@@ -216,4 +217,62 @@ defmodule Berrypod.OrdersTest do
       assert is_nil(Orders.get_order_by_number("SS-000000-XXXX"))
     end
   end
+
+  describe "list_orders_by_email/1" do
+    test "returns paid orders for the given email" do
+      order = order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+
+      results = Orders.list_orders_by_email("buyer@example.com")
+      ids = Enum.map(results, & &1.id)
+
+      assert order.id in ids
+    end
+
+    test "excludes pending and failed orders" do
+      order_fixture(%{customer_email: "buyer@example.com"})
+      order_fixture(%{customer_email: "buyer@example.com", payment_status: "failed"})
+
+      assert Orders.list_orders_by_email("buyer@example.com") == []
+    end
+
+    test "excludes other customers' orders" do
+      order_fixture(%{customer_email: "other@example.com", payment_status: "paid"})
+
+      assert Orders.list_orders_by_email("buyer@example.com") == []
+    end
+
+    test "is case-insensitive" do
+      order = order_fixture(%{customer_email: "Buyer@Example.COM", payment_status: "paid"})
+
+      results = Orders.list_orders_by_email("buyer@example.com")
+      ids = Enum.map(results, & &1.id)
+
+      assert order.id in ids
+    end
+
+    test "preloads items" do
+      order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+
+      [order] = Orders.list_orders_by_email("buyer@example.com")
+      assert Ecto.assoc_loaded?(order.items)
+    end
+
+    test "returns newest first" do
+      old = order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+      new = order_fixture(%{customer_email: "buyer@example.com", payment_status: "paid"})
+
+      # Force different inserted_at by updating order records
+      now = DateTime.utc_now() |> DateTime.truncate(:second)
+      earlier = DateTime.add(now, -60, :second)
+
+      Berrypod.Repo.update_all(
+        from(o in Berrypod.Orders.Order, where: o.id == ^old.id),
+        set: [inserted_at: earlier]
+      )
+
+      [first, second] = Orders.list_orders_by_email("buyer@example.com")
+      assert first.id == new.id
+      assert second.id == old.id
+    end
+  end
 end