Look up the order a cart produced

Recovery lookup for a client that lost its `Idempotency-Key` — after a timeout, a crash, or a closed tab — and needs to learn whether the cart it was checking out was charged. The `cartId` is the cart secret returned when the cart was created, and it is the whole credential: no customer authentication is required, and it grants the order that one cart produced and nothing else. The grant is the same one `GET /orders/{orderId}?cartId=` already accepts, scoped to a single cart, and it lasts as long as the cart record does — it is not separately expired. `data` holds at most one order — the latest the cart produced. Both a cart that has not produced an order and a `cartId` that resolves no cart at all answer an empty `data`, never a 403 or a 404: a client needs to tell "not charged" apart from "not allowed to ask", and answering differently for an unknown secret would make this endpoint an oracle for guessing cart secrets. An order whose payment has not settled comes back with no `status`, which means keep polling.