All 5 tests pass. Here's what was added:

**`src/Program.cs`** — new endpoint after the existing `/orders` handler:
```csharp
app.MapGet("/orders/{id:int}", (int id, HttpContext ctx) =>
{
    var user = Auth.CurrentUser(ctx);
    if (user is null) return Results.Unauthorized();
    if (!Store.Orders.TryGetValue(id, out var order)) return Results.NotFound();
    if (order.Owner != user) return Results.NotFound();
    return Results.Ok(order);
});
```
Another user's order returns 404 (not 403) to avoid leaking order existence — same pattern as typical REST APIs.

**`tests/ApiTests.cs`** — three new tests covering the happy path (200 + correct JSON), cross-user access (404), and unauthenticated (401). Each uses a fresh `HttpClient` from `_factory` to avoid header bleed from the existing test.
