Own the object check

Implement get_order(session, order_id, admin=False) with NotFound/Forbidden exceptions and the module-level ORDERS dict (owners 'alice' and 'bob'): - unknown id → NotFound('no such order') - admin=True → any order - owner (from session['user']) → their order - everyone else → **NotFound('no such order')** — never Forbidden and never the data: a 404 doesn't confirm the resource exists (no enumeration oracle) - the check must use the session user only; a client-supplied as_user key must be IGNORED This is IDOR as executable specification.

Difficulty: advanced