feat: enforce company authorization on order details and success pages

shop/app/order/page.tsx

@@ -78,7 +78,8 @@ async function OrderDataWrapper({ orderId }: { orderId?: string }) {
 
     const isAdmin = userData?.role === 'admin'
     const isOwner = orderData.user_id === user.id
-    if (!isAdmin && !isOwner) {
+    const isCompanyMember = userData?.company_id && orderData.company_id === userData.company_id
+    if (!isAdmin && !isOwner && !isCompanyMember) {
       redirect('/order')
     }