add persistent email session for order lookup and reviews

Replaces the short-lived (1 hour) session-based order lookup with a
persistent cookie-based email session lasting 30 days. This foundation
enables customers to leave reviews and view orders without re-verifying
their email each time.

- Add EmailSession module for signed cookie management
- Add EmailSession plug to load verified email into session
- Set email session on order lookup verification
- Set email session on checkout completion (via /checkout/complete)
- Update orders and order detail pages to use email session
- Add reviews system plan document

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

lib/berrypod_web/plugs/email_session.ex

@@ -0,0 +1,26 @@
+defmodule BerrypodWeb.Plugs.EmailSession do
+  @moduledoc """
+  Plug that loads the verified email from the email session cookie into assigns.
+
+  This makes `@email_session` available in controllers and LiveViews,
+  containing the verified email address if the customer has one.
+  """
+
+  import Plug.Conn
+
+  alias Berrypod.EmailSession
+
+  def init(opts), do: opts
+
+  def call(conn, _opts) do
+    case EmailSession.get_email(conn) do
+      {:ok, email} ->
+        conn
+        |> assign(:email_session, email)
+        |> put_session("email_session", email)
+
+      :error ->
+        assign(conn, :email_session, nil)
+    end
+  end
+end