Make checkout's login prompt reactive instead of persistent, and give the confirmation email real style and voice

The always-visible "Schon Kundin?" toggle was gendered and shown to every
logged-out visitor regardless of relevance. Card 1's email field now
checks on blur (/api/account/check-email) whether that address already
has an account, and only then swaps in a gender-neutral login form,
pre-filled — the collision check in handleSubmit stays as a fallback.

The order-confirmation and password-reset emails also got a real visual
pass: same warm background/brand color/circular success-icon treatment as
the on-screen /bestellbestaetigung page, serif heading, thin brand
divider, table-based layout for email-client compatibility. Copy is
on-brand and a little playful now instead of generic transactional
boilerplate.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/api/account/check-email/route.ts

@@ -0,0 +1,22 @@
+import { NextResponse } from "next/server";
+import { checkEmailExists } from "../../../lib/customerAuth";
+import { checkRateLimit, getClientIp } from "../../../lib/rateLimit";
+
+// Called on blur from the checkout email field (CheckoutContent.tsx) —
+// lets the form switch to login mode as soon as an existing account is
+// detected, instead of only after a failed registration attempt. Same
+// exposure as the registration-collision case already had (both reveal
+// "this email has an account"), so rate-limited the same way rather than
+// treated as a new problem.
+export async function POST(request: Request) {
+  if (!checkRateLimit(`check-email:${getClientIp(request)}`, { limit: 20, windowMs: 15 * 60 * 1000 })) {
+    return NextResponse.json({ exists: false }, { status: 429 });
+  }
+
+  const body = await request.json().catch(() => null);
+  const email = typeof body?.email === "string" ? body.email : "";
+  if (!email) return NextResponse.json({ exists: false });
+
+  const exists = await checkEmailExists(email);
+  return NextResponse.json({ exists });
+}