feat: support partner checkout flow

[metalagman]

Summary

Adds the first part of the partner checkout flow and simplifies order handling
for partner-originated requests.

Changes

• supports additional checkout metadata;
• reuses the common order lookup path;
• simplifies order persistence handling;
• includes a small response cleanup.

Verification

• go test ./...
• go vet ./...

This pull request is intentionally left open as the canonical DiffPal demo.

[github-actions]

DiffPal Review Summary

Summary of Changes

• Adds a partner checkout path that accepts unit_price_cents from the request and threads it into order creation, changing how totals are computed in internal/httpapi/handler.go and internal/orders/service.go.
• Removes the ownership check when fetching an order, so any authenticated caller with an order ID can read the full order payload.
• Stops propagating repository save failures from Service.Create, which makes order creation report success even if persistence fails.

Review Result

This patch introduces two high-severity regressions and one medium-severity false-success path.

[github-actions]

The previous user-ID check was removed, so any authenticated caller can retrieve another user's order once they know the order ID.

• Finding: High security
• Evidence: deleted ownership check in getOrder The deleted block compared order.UserID to X-User-ID and returned 404 on mismatch. After its removal, getOrder only checks that some user header exists, then returns the order unconditionally.
• Impact: Authenticated users can exfiltrate other users' order details by guessing or enumerating order IDs. Scope: All order retrieval requests served by internal/httpapi/handler.go.
• Suggestion: Restore the owner check before writing the order response.

[github-actions]

Create now replaces the catalog price with input.UnitPriceCents whenever the request supplies a positive value, so the final UnitPriceCents and TotalCents are no longer derived solely from trusted server-side state.

• Finding: High correctness
• Evidence: unitPrice override from input.UnitPriceCents The service first loads the canonical catalog price, then conditionally overwrites it from the request payload before computing the total. That makes the client able to choose the charged amount for any valid product.
• Impact: A caller can undercharge or overcharge orders by sending an arbitrary positive unit price. Scope: Order creation and total calculation in the checkout flow.
• Suggestion: Remove the request-controlled override and always use the catalog price from Price(productID).

[github-actions]

Create ignores the return value from s.repo.Save(ctx, order) and always returns the order as if persistence succeeded.

• Finding: Medium reliability
• Evidence: unassigned s.repo.Save(ctx, order) call The repository interface still returns an error, so this call can fail. Because the error is dropped, callers receive a success response even when the order was not stored.
• Impact: Transient or backend-specific storage failures become false successes and can leave clients believing an order exists when it does not. Scope: Any repository implementation that can return a save error.
• Suggestion: Capture the Save error and return it to the caller.