fix: 订单详情强制按登录用户过滤，修复 IDOR 越权

- 原实现 userId 参数由客户端控制，不传则跳过归属校验，
  任意登录用户可凭订单号查看他人订单详情
- 改为查询条件强制 eq(userId, 登录用户)，他人订单返回不存在

Co-Authored-By: Claude <noreply@anthropic.com>

car-wash-service/src/main/java/com/kym/service/impl/WashOrderServiceImpl.java

@@ -288,14 +288,12 @@ public class WashOrderServiceImpl extends MyBaseServiceImpl<WashOrderMapper, Was
      */
     @Override
     public WashOrder queryOrder(WashOrderQueryParams params) {
-        // 非实时数据
+        // C 端订单详情：强制按当前登录用户过滤，防止通过订单号越权查看他人订单
         WashOrder order = lambdaQuery()
                 .eq(WashOrder::getOrderId, params.getOrderId())
+                .eq(WashOrder::getUserId, StpUtil.getLoginIdAsLong())
                 .one();
-        if (null != params.getUserId()) {
-            CommUtil.asserts(null != order && order.getUserId().equals(StpUtil.getLoginIdAsLong()),
-                    "订单不存在或您没有权限查看该订单!");
-        }
+        CommUtil.asserts(null != order, "订单不存在或您没有权限查看该订单!");
         return order;
     }