Root cause: OrderController.Continue (GET /order/continue) was calling
MarkTokenUsed the moment the link loaded, not when the customer
actually submitted the order. This burns a one-time link before the
customer opens it whenever anything else issues a GET first - most
likely mail security link-scanners (e.g. Outlook Safe Links) that
pre-fetch URLs found in email bodies, which matches the admin site's
mailto-link workflow.

- OrderController.Continue: only checks TokenUsedAt/TokenExpiresAt for
  validity now, no longer marks the token used
- OrderApiController.SubmitOrderDetails: rejects an already-used token
  (410), and marks the token used only after the order details are
  successfully saved