Add password reset, order confirmation email with editable templates, and fix missing account entry points

Password reset uses Payload's built-in forgot/reset-password flow,
customized to link to this app instead of the Payload admin. Order
confirmation email and the password-reset email's wording both come from
a new Payload email-templates collection, editable without a deploy and
previewable via Live Preview at /email-preview/[type] (same mechanism as
Posts/LegalPages/Testimonials, sample data instead of a real document).

Also: order numbers get a random suffix (prevents guessing, motivated by
a considered-and-deferred guest order-lookup feature); the discount code
field only shows in the cart when a code is actually active (codes now
apply via a ?code= link instead of manual entry); and three navigation
gaps found while testing — no reachable login link with an empty cart, no
logout link anywhere, no way back from profile to order history.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/konto/components/LogoutButton.tsx

@@ -0,0 +1,19 @@
+"use client";
+
+import { useRouter } from "next/navigation";
+
+export function LogoutButton() {
+  const router = useRouter();
+
+  async function handleLogout() {
+    await fetch("/api/account/logout", { method: "POST" });
+    router.push("/");
+    router.refresh();
+  }
+
+  return (
+    <button type="button" onClick={handleLogout} className="underline text-body-sm text-text-primary hover:text-brand transition-colors">
+      Abmelden
+    </button>
+  );
+}

app/konto/components/OrderStatusBadge.tsx

@@ -0,0 +1,28 @@
+import { ORDER_STATUS_LABEL } from "../../lib/customerAuth";
+
+// Colors are a rough "how good is this news" scale — neutral while
+// in-progress, success once actually delivered, warm/red for anything
+// that means the order didn't complete as planned. Reuses existing tokens
+// where they exist (--color-brand, --color-success/-subtle); cancelled/
+// return_requested borrow plain Tailwind red/orange since this codebase
+// has no custom tokens for those (same reasoning as the existing
+// text-red-600 error-text convention elsewhere).
+const STYLES: Record<string, string> = {
+  received: "bg-bg-muted text-text-muted",
+  processing: "bg-brand/10 text-brand",
+  shipped: "bg-brand/10 text-brand",
+  delivered: "bg-success-subtle text-success",
+  cancelled: "bg-red-50 text-red-600",
+  return_requested: "bg-orange-50 text-orange-600",
+  returned: "bg-bg-muted text-text-light",
+};
+
+export function OrderStatusBadge({ status }: { status: string }) {
+  return (
+    <span
+      className={`inline-flex items-center px-2.5 py-1 rounded-full text-label font-bold whitespace-nowrap ${STYLES[status] ?? "bg-bg-muted text-text-muted"}`}
+    >
+      {ORDER_STATUS_LABEL[status] ?? status}
+    </span>
+  );
+}