Done. The new endpoint in `app/main.py` handles three cases:

- **404** — `order_id` not in the store
- **403** — order exists but belongs to a different user (prevents IDOR)
- **200** — order found and owned by the caller, returned as JSON
