Add password reset, order confirmation email with editable templates, and fix missing account entry points

Password reset uses Payload's built-in forgot/reset-password flow,
customized to link to this app instead of the Payload admin. Order
confirmation email and the password-reset email's wording both come from
a new Payload email-templates collection, editable without a deploy and
previewable via Live Preview at /email-preview/[type] (same mechanism as
Posts/LegalPages/Testimonials, sample data instead of a real document).

Also: order numbers get a random suffix (prevents guessing, motivated by
a considered-and-deferred guest order-lookup feature); the discount code
field only shows in the cart when a code is actually active (codes now
apply via a ?code= link instead of manual entry); and three navigation
gaps found while testing — no reachable login link with an empty cart, no
logout link anywhere, no way back from profile to order history.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/api/checkout/route.ts

@@ -6,6 +6,7 @@ import { createOrder } from "../../lib/orderServer";
 import { getSessionCustomer, registerCustomer, setSessionCookie, type CustomerSummary } from "../../lib/customerAuth";
 import { fetchProductsBySlug } from "../../lib/productsServer";
 import { sendCriticalAlert } from "../../lib/alertAdmin";
+import { sendOrderConfirmationEmail } from "../../lib/orderEmail";
 
 type CheckoutBody = {
   cart: CartItem[];
@@ -154,6 +155,31 @@ export async function POST(request: Request) {
     return NextResponse.json({ ok: false, reason: "Bestellung konnte nicht gespeichert werden." }, { status: 500 });
   }
 
+  // Fire-and-forget — a failed confirmation email must never undo an
+  // already-successful order or block the response the customer is
+  // waiting on. Lower severity than the "order lost" alert above (the
+  // order itself is safe either way), but still worth knowing about, since
+  // it's the one thing that would otherwise fail completely silently.
+  sendOrderConfirmationEmail(
+    {
+      orderNumber: order.orderNumber,
+      createdAt: order.createdAt,
+      items: items.map((i) => ({ productName: i.productName, quantity: i.quantity, unitPrice: i.unitPrice })),
+      subtotal,
+      shippingCost,
+      discountAmount,
+      discountCode: body.discountCode || null,
+      total,
+    },
+    body.email,
+  ).catch((err) => {
+    sendCriticalAlert("Bestätigungs-Mail konnte nicht gesendet werden", {
+      orderNumber: order.orderNumber,
+      customerEmail: body.email,
+      error: String(err),
+    });
+  });
+
   return NextResponse.json({
     ok: true,
     orderNumber: order.orderNumber,