Document the 3 new email types and the cross-origin Live Preview limitation

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -120,7 +120,7 @@ explains what does have access instead.
 | `orders` | Persisted checkout orders, `/konto/bestellungen*` | `orderNumber`, `invoiceNumber`/`invoiceIssuedAt`, `correctionInvoiceNumber`/`correctionInvoiceIssuedAt` (see "Invoice PDFs" below), `status` (`received`/`processing`/`shipped`/`delivered`/`cancelled`/`return_requested`/`returned` — the first 4 maintained by hand in the admin, no carrier API; the rest see "Order cancellation & returns"), `returnReason` (captured from the customer on a return request), full address/items (each with a snapshotted `taxRatePercent`/`bundleContents`)/totals at order time. **Not public-read** — created only via `ORDER_SERVICE_SECRET`, read/updated by admin or the order's own customer |
 | `customers` | Storefront accounts — register/login/order-history, a second `auth: true` collection separate from the Payload admin's own `users` login | `customerNumber`, `firstName`/`lastName`/`email`, one default address, `cart` (server-side mirror), `emailVerified` (non-blocking). **Not public-read** — see "Orders & customer accounts" below |
 | `number-ranges` | Admin-configurable prefix + running counter for customer/order/invoice/correction-invoice numbers — one row per tenant | `customerPrefix`/`customerNext`/`customerPadding`, `orderPrefix`/`orderNext`/`orderPadding`, `invoicePrefix`/`invoiceNext`/`invoicePadding`, `correctionInvoicePrefix`/`correctionInvoiceNext`/`correctionInvoicePadding` (Stornorechnung/Gutschrift — its own gapless sequence, not the same counter as `invoice*`, see "Invoice PDFs" below). **Admin-only**, no frontend read at all — internal to the two `beforeChange` hooks that assign these numbers |
-| `email-templates` | Editable subject/heading/body/footer for all 6 transactional emails this shop sends (see "Email templates & Live Preview" and "Status-change emails" below) | `type` (`order-confirmation`/`password-reset`/`order-shipped`/`order-cancelled`/`order-return-requested`/`order-returned`), `subject`, `heading`, `bodyText`, `footerText`. Public-read, has a Live Preview button |
+| `email-templates` | Editable subject/heading/body/footer for all 9 transactional emails this shop sends (see "Email templates & Live Preview" and "Status-change emails" below) | `type` (`order-confirmation`/`password-reset`/`order-shipped`/`order-cancelled`/`order-return-requested`/`order-returned`/`order-tracking-added`/`order-tracking-corrected`/`order-delivered`), `subject`, `heading`, `bodyText`, `footerText`. Public-read, has a Live Preview button |
 | `company-settings` | Structured business data for invoice PDFs *and* every email's legal footer (Anbieterkennzeichnung, see "Invoice PDFs" below) — one row per tenant, own **Company** admin group (not Commerce — this is business identity, not a storefront concern) | `sellerName`/`sellerStreet`/`sellerZip`/`sellerCity`/`sellerCountry`/`sellerEmail`, `vatId`, `taxRatePercent` (admin-editable, not hardcoded), `bankName`/`iban`/`bic` (`iban`/`bic` format-validated + uppercase-normalized; `bankName` stays free text — replaced a single free-text `bankDetails` field). **Not public-read** — admin or `ORDER_SERVICE_SECRET`. Has a Live Preview button — see "Company Settings & Live Preview" below |
 
 All of the above except `company-settings`, `media`, `users`, `tenants`
@@ -1465,13 +1465,33 @@ links to `/konto/passwort-vergessen`.
 
 ### Email templates & Live Preview
 
-All 6 transactional emails (order confirmation, password reset, and the 4
-status-change types below) read their subject/heading/body/footer wording
-from Payload's `email-templates` collection — editable in the admin
-without a deploy, with a Live Preview button using the exact same
-mechanism as Posts/LegalPages/Testimonials (`useLivePreview()` from
-`@payloadcms/live-preview-react`, already a dependency here for
-`LivePostContent.tsx`).
+All 9 transactional emails (order confirmation, password reset, and the 7
+status-change types below — the original 4 plus `order-tracking-added`/
+`order-tracking-corrected`/`order-delivered`, added 2026-07-25) read their
+subject/heading/body/footer wording from Payload's `email-templates`
+collection — editable in the admin without a deploy, with a Live Preview
+button using the exact same mechanism as Posts/LegalPages/Testimonials
+(`useLivePreview()` from `@payloadcms/live-preview-react`, already a
+dependency here for `LivePostContent.tsx`).
+
+**Live Preview only reliably updates when popped out into its own
+browser tab/window, not in the embedded admin panel.** Root cause: the
+preview goes through `buildPreviewUrl()` on the Payload side, which hits
+`/api/preview` on this frontend's own origin to enable Next.js Draft
+Mode via a cookie — but admin (`payload.mk360.de`) and frontend
+(`einfach-produktiv.mk360.de`) are different origins, so from inside the
+admin's embedded `<iframe>` that's a cross-site/third-party context.
+Modern browsers (Safari by default, Chrome/Firefox increasingly)
+block or partition cookies set inside a cross-site iframe regardless of
+which domain actually issued them, so the Draft Mode cookie doesn't
+reliably persist there. Once popped into its own window it's a top-level
+navigation, not a third-party context, so the cookie sets normally and
+everything works. Affects every Live-Preview-enabled collection in this
+system (Posts/LegalPages/Testimonials too), not just email templates —
+a structural consequence of running admin and frontend on separate
+domains, not something fixable at the collection-config level. A real
+fix would mean serving both under one domain (reverse proxy path) rather
+than two subdomains.
 
 - **`app/lib/emailTemplates.ts`** — pure string-building functions
   (`renderOrderConfirmationHtml()`, `renderPasswordResetHtml()`,