Homework — orders that belong to your account.

1. Place an order. Log in, add pizzas to the cart, "Place order". An order tied to your user should appear in the backend (DB).
2. Check the header. In Logcat (HttpLoggingInterceptor) find POST /orders — it must carry Authorization: Bearer .... And POST /login — without it.
3. History is per-user. Open order history (GET /orders) — you see your order. Then log out, create a second account, log in with it — the history is empty ("No orders yet"). The server scopes data by token.
4. 401 experiment. Manually "corrupt" the token in storage (or wait for it to expire) and open history → GET /orders returns 401 → Error. Ideally your 401 handling sends the user back to login.

Required tests:

• Ownership test: two users — each sees only their own orders.
• Header test: POST /orders carries Authorization, POST /login does not.

To submit: screenshots: (1) order history with your order, (2) the Logcat line with Authorization: Bearer on /orders.

Next. Orders work, but tableNumber is null for now. In lesson 10 we add QR scanning (CameraX + ML Kit): scan the table's code, and placeOrder() sends table_number — the pizza arrives at exactly your table. Then lesson 11 — Stripe payment.