I don't have permission to run the tests directly. Here's what was added:

**`app/main.py`** — new route registered *before* `/orders` so FastAPI's router matches it first:

```python
@app.get("/orders/search")
def search_orders(q: str, user: str = Depends(current_user)) -> list[dict]:
    return [
        o for o in ORDERS.values()
        if o["owner"] == user and q.lower() in o["item"].lower()
    ]
```

**`tests/test_app.py`** — five new tests covering: basic match, case-insensitivity, caller scoping (bob can't see alice's orders), no-match empty list, and missing auth → 422.

The `/orders/search` route must be declared before `/orders` because FastAPI matches routes in registration order — if `/orders` were first, a path like `/orders/search` would be matched before the literal segment check reached the `search` route.
