All 3 tests pass. Here's what was added:

**`src/Program.cs`** — new route that authenticates the caller, then filters the in-memory store by owner and does a case-insensitive `Contains` on the `Item` field. An empty or missing `q` param returns all of the caller's orders.

**`tests/ApiTests.cs`** — `Search_returns_matching_orders_case_insensitively` authenticates as alice, searches for `WIDGET` (uppercase), and asserts only order id 1 is returned — verifying both the case folding and that bob's `gizmo` order is excluded.
