Fix: token marked used on link view instead of order submission

Root cause: OrderController.Continue (GET /order/continue) was calling
MarkTokenUsed the moment the link loaded, not when the customer
actually submitted the order. This burns a one-time link before the
customer opens it whenever anything else issues a GET first - most
likely mail security link-scanners (e.g. Outlook Safe Links) that
pre-fetch URLs found in email bodies, which matches the admin site's
mailto-link workflow.

- OrderController.Continue: only checks TokenUsedAt/TokenExpiresAt for
  validity now, no longer marks the token used
- OrderApiController.SubmitOrderDetails: rejects an already-used token
  (410), and marks the token used only after the order details are
  successfully saved

app/controllers/OrderApiController.asp

@@ -60,6 +60,11 @@ Class OrderApiController_Class
             Exit Sub
         End If
 
+        If Not IsNull(order("TokenUsedAt")) Then
+            WriteJsonError "410 Gone", "This order has already been submitted."
+            Exit Sub
+        End If
+
 
         Dim csrfToken : csrfToken = Request.ServerVariables("HTTP_X_CSRF_TOKEN")
         If Not HTMLSecurity().IsValidAntiCSRFToken("Order.Continue", csrfToken) Then
@@ -114,6 +119,7 @@ Class OrderApiController_Class
         End If
         On Error GoTo 0
 
+        OrdersRepository().MarkTokenUsed order("OrderID")
 
         ' Best-effort: the order is already safely persisted at this point, so an SMTP hiccup
         ' should not turn a successful submission into a failed one.

app/controllers/OrderController.asp

@@ -40,9 +40,13 @@ Class OrderController_Class
         If Len(token) > 0 Then
             Set order = OrdersRepository().FindByToken(token)
             If Not (order Is Nothing) Then
+                ' Only checks validity here - the token is marked used when the order is
+                ' actually submitted (OrderApiController.SubmitOrderDetails), not on this GET.
+                ' Marking it used here would burn a one-time link the moment it's merely
+                ' opened/previewed (e.g. by mail security link-scanners), before the
+                ' customer ever sees the form.
                 If IsNull(order("TokenUsedAt")) And order("TokenExpiresAt") >= Now() Then
                     isValid = True
-                    OrdersRepository().MarkTokenUsed order("OrderID")
                 End If
             End If
         End If