[ORD-002] Orders: Order confirmation page & email receipt

## Overview
After a successful order is placed, redirect the user to a confirmation page and send an email receipt.

## Acceptance Criteria
- [ ] Route: `/order/confirmation/:orderId` shows order summary
- [ ] Confirmation page displays: order ID, estimated delivery date, items purchased, total paid, shipping address
- [ ] "Track Order" placeholder (links to order detail once fulfillment tracking is added)
- [ ] Email receipt sent automatically via notification service (#19) — contains same info as confirmation page
- [ ] Confirmation page is accessible for 30 days after order (even without being logged in, via token in URL)
- [ ] If order ID is invalid or doesn't belong to the user, show a 404 state

## Depends On
- #14 ORD-001 — order must exist before confirmation is rendered

Start by reviewing the order created by #14 and the notification service planned in #19. Implement the confirmation route and page, receipt delivery, token-based 30-day access, and invalid-or-unauthorized 404 behavior; done means every listed acceptance criterion is satisfied.

Written by the indexing model from the issue text.