All 4 tests pass. Here's what was added:

**`src/Program.cs`** — new endpoint after the existing `/orders` handler:
```csharp
app.MapGet("/orders/{id}", (int id, HttpContext ctx) => { ... });
```
The ownership check is part of the query — `order.Owner != user` — so a caller who doesn't own the order gets 404, not 403 (no resource existence leak).

**`tests/ApiTests.cs`** — two new tests:
- `GetOrder_returns_own_order_as_json` — happy path: alice fetches her order 1, gets full JSON back.
- `GetOrder_returns_404_for_another_users_order` — IDOR proof: alice requests bob's order 3, gets 404. This is the authorization-failure test the endpoint can't ship without.

Each new test creates its own `HttpClient` from the stored factory to keep auth headers isolated from the shared `_client`.
