Done. Here's what was added:

**`app/main.py`** — new endpoint at line 27–31:
- Requires auth via `Depends(current_user)`, same as `GET /orders`
- Ownership predicate (`o["owner"] == user`) is inside the filter — no IDOR: a query matching another user's item returns nothing
- Case-insensitive via `.lower()` on both sides

**`tests/test_app.py`** — four new tests:
- `test_search_returns_matching_items_for_caller` — basic happy path
- `test_search_is_case_insensitive` — uppercase query still matches
- `test_search_is_scoped_to_the_caller` — IDOR guard: alice searching for bob's "gizmo" returns `[]`
- `test_search_requires_auth` — missing header → 422
