Wire up product variants end-to-end, add tracking-number display

Completes the frontend half of the Payload backend's variant/inventory/
tracking work (see that repo's own commit):

- **Cart**: CartItem gained an optional `variant?: string` field — every
  function that used to match a line by `id` alone (addToCart/
  removeFromCart/setQuantity) now matches by `(id, variant)` together via
  a shared sameLine() helper, so two lines for the same product with
  different variants stay separate entries. `variant` undefined on both
  sides (the no-variants case) still matches by simple equality, so every
  pre-existing call site keeps working unchanged.
- **Selection UI**: AddToCartInlineButton renders a <select> above the
  button when given a non-empty `variants` prop (ProductGrid/
  RelatedProducts pass product.variants straight through); defaults to
  the first variant.
- **Pricing**: cartTotals.ts's new effectivePrice(entry, product) — a
  variant's priceOverride wins over the base product price. Every cart/
  checkout/order-confirmation total and per-line price display now goes
  through this instead of reading product.price directly (fixes both a
  wrong-price bug and a duplicate-React-key bug the old `key={product.id}`
  pattern would have had the moment two variants of one product were both
  in the cart).
- **Checkout**: re-validates the requested variant server-side (same
  "never trust the client" reasoning as price re-derivation) — a variant
  name that doesn't exist on that product fails the whole checkout.
  variantName snapshots onto orders.items, shown as a parenthetical next
  to the product name on the confirmation email, both invoice PDF types,
  and the order-detail page.
- **Cross-device cart**: Customers.cart[].variantName (synced via
  /api/account/cart) carries the selection through a login/logout cycle,
  not just the current session.

Also adds tracking-number display: /konto/bestellungen/[orderNumber]
shows a clickable link when orders.trackingNumber is set, built by a new
app/lib/tracking.ts that mirrors the Payload backend's own copy
byte-for-byte close (same carrier set/URL patterns) so what a customer
sees here matches exactly what the order-shipped email already links to.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/api/account/cart/route.ts

@@ -22,12 +22,11 @@ export async function POST(request: Request) {
   const cart: CartItem[] = Array.isArray(body?.cart) ? body.cart : [];
 
   const productsBySlug = await fetchProductsBySlug();
-  const lines = cart
-    .map((item) => {
-      const product = productsBySlug.get(item.id);
-      return product ? { productId: product.id, productSlug: product.slug, quantity: item.qty } : null;
-    })
-    .filter((line): line is { productId: number; productSlug: string; quantity: number } => line !== null);
+  const lines: { productId: number; productSlug: string; quantity: number; variant?: string }[] = [];
+  for (const item of cart) {
+    const product = productsBySlug.get(item.id);
+    if (product) lines.push({ productId: product.id, productSlug: product.slug, quantity: item.qty, variant: item.variant });
+  }
 
   const ok = await saveServerCart(session.token, session.customer.id, lines);
   return NextResponse.json({ ok });

app/api/checkout/route.ts

@@ -98,19 +98,30 @@ export async function POST(request: Request) {
     imageUrl: string | null;
     taxRatePercent: number;
     bundleContents: string | null;
+    variantName: string | null;
   }[] = [];
   for (const line of body.cart) {
     const product = productsBySlug.get(line.id);
     if (!product) return NextResponse.json({ ok: false, reason: "Ein Artikel im Warenkorb ist nicht mehr verfügbar." }, { status: 400 });
+    // Same "never trust the client" reasoning as unitPrice below — a
+    // requested variant that no longer exists on this product (removed,
+    // or never existed — a tampered request) fails the whole checkout
+    // rather than silently falling back to the base product/price.
+    let variant: { name: string; priceOverride: number | null } | null = null;
+    if (line.variant) {
+      variant = product.variants?.find((v) => v.name === line.variant) ?? null;
+      if (!variant) return NextResponse.json({ ok: false, reason: "Eine gewählte Variante ist nicht mehr verfügbar." }, { status: 400 });
+    }
     const imageUrl = typeof product.image === "object" && product.image ? product.image.url : null;
     items.push({
       productId: product.id,
       productName: product.name,
       quantity: line.qty,
-      unitPrice: product.price,
+      unitPrice: variant?.priceOverride ?? product.price,
       imageUrl,
       taxRatePercent: product.taxRatePercent ?? defaultTaxRate,
       bundleContents: describeBundleContents(product),
+      variantName: variant?.name ?? null,
     });
   }
   const subtotal = items.reduce((sum, i) => sum + i.quantity * i.unitPrice, 0);
@@ -202,6 +213,7 @@ export async function POST(request: Request) {
         imageUrl: i.imageUrl,
         taxRatePercent: i.taxRatePercent,
         bundleContents: i.bundleContents,
+        variantName: i.variantName,
       })),
       subtotal,
       shippingCost,