security: gate analytics/orders/suppliers/customers behind admin JWT; sanitize public order tracking

backend/app/schemas.py

@@ -135,6 +135,18 @@ class OrderOut(ORMModel):
     updated_at: Optional[datetime] = None
 
 
+class CustomerOrderOut(ORMModel):
+    id: UUID
+    order_number: str
+    items: Any
+    retail_total: float
+    status: str
+    tracking: Optional[str] = None
+    carrier: Optional[str] = None
+    created_at: Optional[datetime] = None
+    updated_at: Optional[datetime] = None
+
+
 class TrackingIn(BaseModel):
     tracking: str
     carrier: Optional[str] = None