Issue #3620301: Offer the cancel link on any surface, not only in the confirmation mail

CancelLinkBuilder already calls itself the one place that mints the signed cancel URL, for "the confirmation screen, the confirmation email, an account view". Only the mail ever asked.

[yoyaku-order:cancel-url] hands out that link, so a message can carry it from config the way [yoyaku-order:bookings] already carries the booking list. Same builder, so a page and a mail cannot disagree about whether cancellation is open or where the link goes.

• The token clears where cancellation is closed, so a surface that prints it never shows a link that would refuse on arrival.
• The link dies at the cancellation deadline, so the replacement carries the time left as a max age, and is not cacheable at all where no deadline is known.

Two kernel tests: the token clears where cancellation is not open, and where it is, it equals what CancelLinkBuilder mints (asserted against the builder rather than a spelling of a URL, so the two cannot drift). Checked against a stubbed-out token to be sure the assertion bites.