Everything looks correct. Here's what was added:

**`app/main.py`**
- `CreateOrderRequest` Pydantic model accepts `item`, `quantity`, `unit_price` — no `owner` field (it's server-controlled)
- `POST /orders` endpoint: sets `owner` from the `current_user` dependency (the auth token), never from the body; returns 201 with the created order

**`tests/test_app.py`**
- `autouse` `reset_orders` fixture snapshots and restores `ORDERS` between tests — needed because the existing `test_list_orders_is_scoped_to_the_caller` checks exact IDs and would fail if test order created new entries
- `test_create_order_returns_created_order`: verifies 201 and all fields
- `test_create_order_owner_is_caller_not_body`: proves `owner` is set from the token, not a body field
- `test_create_order_requires_auth`: 401 on missing token
- `test_created_order_not_visible_to_other_user`: cross-user IDOR check — Alice's new order doesn't appear in Bob's list
