[ORD-001] Orders: Order service — create, store, and retrieve orders

## Overview
Build the core order service that converts a finalized cart into an order record, handles payment intent creation (stubbed), and stores the order for future retrieval.

## Acceptance Criteria
- [ ] `POST /api/orders` — creates an order from current cart, returns order ID and summary
- [ ] Order record stores: user ID, items (snapshot of product at purchase time), quantities, prices, discounts applied, shipping address, status, timestamps
- [ ] Order statuses: `pending_payment` → `confirmed` → `processing` → `shipped` → `delivered`
- [ ] `GET /api/orders/:orderId` — returns order detail for the owning user
- [ ] `GET /api/orders` — returns paginated order list for current user
- [ ] Payment processing is **stubbed** (always succeeds) — real payment gateway is a post-MVP concern
- [ ] Cart is cleared after successful order creation
- [ ] Order confirmation triggers notification (#15 and #19)

## Depends On
- #3 CART-003 — cart contents are the input to this service
- #5 AUTH-001 — orders are tied to authenticated user accounts

## Blocks
- #15 ORD-002 (confirmation page reads the new order)
- #17 ACC-012 (order history queries this service)
- #18 OPS-009 (returns reference order IDs)
- #19 NOTIF-001 (order events trigger notifications)
- #20 REVIEW-001 (reviews require a verified order)