Restrict Rücksendung anfragen to delivered orders, fix Impressum email link

- customerOrderAction() only offers "Rücksendung anfragen" once an order
  is delivered, not already at shipped — a return before the package
  arrived doesn't make sense yet. UI-only change (a stricter subset of
  what the backend's CUSTOMER_ALLOWED_TRANSITIONS already permits).
- AnbieterAngaben.tsx's seller email is now a real mailto: link — it was
  plain text, the only non-clickable email on the site.

README.md

@@ -2072,6 +2072,31 @@ had `isManualPayment: false` — the Vorkasse/Überweisung branch (and its
 new switch-option mention) was never previewable in the admin at all
 before this.
 
+**Follow-up same day: switch-to-stripe eligibility narrowed.**
+`canSwitchPayment` (page.tsx) and the `switch-to-stripe` route's own
+re-check both changed from `paymentStatus !== "paid"` to an explicit
+allowlist (`"pending"` or `"not_applicable"`) — see the Payload backend's
+own README for why the blocklist form was too permissive. No visible
+behavior change for the normal case, just closes an edge case
+(`"failed"`/`"refunded"`/`"partially_refunded"` on a manual order — not
+realistic today, but not meaningful states to switch *from* either).
+
+**Two more same-day fixes:**
+- `customerOrderAction()` now only offers "Rücksendung anfragen" once an
+  order is actually `delivered`, not already at `shipped` — a (partial)
+  return before the package has even arrived doesn't make sense yet. The
+  backend's own `CUSTOMER_ALLOWED_TRANSITIONS` still technically permits
+  `shipped` → `return_requested` too (an extensive existing test suite is
+  built around that as its base fixture, see the Payload backend's
+  README) — this only narrows what the UI itself offers, a stricter
+  subset of what the backend already allows, not a security boundary
+  being loosened.
+- `/impressum`'s "Angaben zum Anbieter" email (`AnbieterAngaben.tsx`) was
+  plain text, not a `mailto:` link — the only email address on the whole
+  site that wasn't clickable, since this one section is rendered
+  straight from `company-settings` fields rather than through the CMS
+  richText renderer (which already links emails/URLs correctly).
+
 ## Deployment
 
 - **Dockerfile**: 3-stage build (`deps` → `builder` → `runner`) with