All 4 tests pass. Here's a summary of the changes:

**`src/Store.cs`** — added `CreateOrderRequest(string Item, int Quantity)` DTO. `unitPrice` is intentionally absent: the endpoint resolves it from `Store.Products` rather than trusting the client to supply it (prevents price-tampering).

**`src/Program.cs`** — added `POST /orders` that:
- Returns 401 if unauthenticated
- Returns 400 if the item isn't in the catalog
- Sets `Owner` from the authenticated identity (not the body) and `UnitPrice` from the catalog
- Returns 201 Created with the full order

**`tests/ApiTests.cs`** — two new tests using per-request headers (via `HttpRequestMessage`) to avoid `DefaultRequestHeaders` state bleed:
- `Creating_order_returns_201_with_caller_as_owner` — verifies correct status, owner, item, quantity, and catalog price
- `Creating_order_unauthenticated_returns_401` — proves the auth gate
