Show cancellation button on unauthenticated order page (cancellation token via cookie/localstorage?)

The order confirmation page is accessible without authentication (order UUID in the URL). Cancellation should be reachable from there.

## Current state (2026-09-02)

Implemented, without a separate token: `RequestCancellationSection` renders on the unauthenticated order page when `order.canRequestCancellation` (server-side `is_cancellable_by_customer`); the actual cancellation is confirmed via an emailed one-time code, and the cancellation link is also included in the receipt email.

Open question: is the originally proposed cookie/localStorage cancellation token still needed for any case the emailed confirmation does not cover? If not, close.