All 5 tests pass. Here's what was added:

**`src/Program.cs`** — new endpoint `GET /orders/search?q=<text>`:
- Returns 401 if unauthenticated
- Returns 400 if `q` is missing/blank
- Filters by `o.Owner == user` in the same predicate as the item match — ownership scope is never an afterthought, so another user's data can't leak through
- Uses `StringComparison.OrdinalIgnoreCase` for case-insensitive substring match

**`tests/ApiTests.cs`** — three new tests:
- `Search_returns_matching_orders_case_insensitively` — alice searches "GET" (uppercase), gets back both "widget" and "gadget"
- `Search_cannot_return_another_users_orders` — bob searches "widget" (alice's item), gets empty list (IDOR guard)
- `Search_without_auth_returns_401` — no token, blocked before the query runs
