The interceptor attaches the token — now let's use it. In the code column — OrderRepository.kt: it takes the cart items (lesson 3), turns them into a CreateOrderRequest and sends POST /orders. There's no token code here — the interceptor adds it. tableNumber is null for now (the QR scan supplies it in lesson 10).

The cart now gets an OrderRepository and can place an order:

// cartModule — the cart grows (lesson-3 in-memory + orders)
single { OrderRepository(get()) }
viewModel { CartViewModel(get()) }        // get() = OrderRepository

// CartViewModel — a new action:
fun placeOrder() = viewModelScope.launch {
    orderRepository.placeOrder(_uiState.value.items, tableNumber = null)  // table = L10
    onEvent(CartEvent.ClearCart)
}

And order history is a new feature (feature/orders), the same MVI shape as the menu:

// data
data class Order(val id: Int, val total: Double, val status: String, val createdAt: String)

class OrderHistoryRepository(private val api: PicaApi) {
    suspend fun getOrders(): List<Order> = api.getOrders().map { dto ->
        Order(dto.id, dto.totalCents / 100.0, dto.status, dto.createdAt)   // cents → euros
    }
}

// presentation — Loading / Success(orders) / Error, init { loadOrders() }
sealed interface OrderHistoryUiState { /* Loading; Success(List<Order>); Error(msg) */ }

// di
val orderHistoryModule = module {
    single { OrderHistoryRepository(get()) }
    viewModel { OrderHistoryViewModel(get()) }
}

OrderHistoryScreen shows cards (Order #id, €%.2f, status), and an empty history reads "No orders yet". Don't forget to register orderHistoryModule in the PicaApplication list and add Screen.OrderHistory to navigation.

Verify. While logged in:

1. Add pizzas to the cart → "Place order" → POST /orders (with the Authorization header).
2. Open order history → GET /orders → you see ONLY your own orders.
3. Log in as a different user → different history (the server scopes by token).

Tip (401 → login). When the token expires, GET /orders returns 401 and getOrders() throws → the Error state. For good UX, add 401 handling that clears the token (logout()) and returns to login — the user simply signs in again.