Orders and access.

No accessible test orders.

Receipts require a short-lived opaque capability cookie; orders are never exposed by email or guessable ID.