Restrict Rücksendung anfragen to delivered orders, fix Impressum email link

- customerOrderAction() only offers "Rücksendung anfragen" once an order
  is delivered, not already at shipped — a return before the package
  arrived doesn't make sense yet. UI-only change (a stricter subset of
  what the backend's CUSTOMER_ALLOWED_TRANSITIONS already permits).
- AnbieterAngaben.tsx's seller email is now a real mailto: link — it was
  plain text, the only non-clickable email on the site.

app/lib/customerAuth.ts

@@ -455,7 +455,14 @@ export const ORDER_STATUS_LABEL: Record<string, string> = {
 // decide which button, if any, to show).
 export function customerOrderAction(status: string): "cancel" | "request-return" | null {
   if (status === "received") return "cancel";
-  if (status === "shipped" || status === "delivered") return "request-return";
+  // Only once actually delivered — a (partial) return before the package
+  // even arrived doesn't make sense yet. The backend's own
+  // CUSTOMER_ALLOWED_TRANSITIONS still technically permits 'shipped' →
+  // 'return_requested' too (an extensive existing test suite is built
+  // around that as its base fixture) — this only narrows what the UI
+  // itself offers, a stricter subset of what the backend already allows,
+  // not a security boundary being loosened.
+  if (status === "delivered") return "request-return";
   return null;
 }