Done. The new endpoint:

- **Authenticates** via the same `current_user` dependency as `list_orders`
- **Scopes by owner** — if the order exists but belongs to another user, it returns 404 (not 403), preventing callers from confirming that an ID exists but is forbidden; this closes the IDOR the OKL briefing flagged
- **Returns 404** for any non-match, keeping the error surface minimal
