Here's what was added:

- **`OrderIn` Pydantic model** (`main.py:28-31`) — validates the three required body fields (`item: str`, `quantity: int`, `unit_price: float`).
- **`POST /orders`** (`main.py:34-39`) — requires auth via `x-user-token`, derives the next ID from the current max, inserts into the in-memory `ORDERS` store, and returns the new order with HTTP 201.
- **Two new tests** in `test_app.py` — one for the happy path (alice creates an order, checks all returned fields), one confirming a missing auth header yields 422.

The `test_list_orders_is_scoped_to_the_caller` test is unaffected because the new test creates orders for alice, not bob.
