fix(order): 关闭按用户 id 撞库档案 id 的订单归属兜底，避免潜在越权读取

- getOrdersForUser/countOrdersForUser 仅按 companions.user_id 关联本人档案，不再使用 companions.id = 用户 id

- 补充回归断言；116 套件/758 用例全绿；线上已验证用户订单仍正常

server/src/db/repository.ts

@@ -1530,12 +1530,12 @@ export class MysqlRepository {
           buyer_id = ?
           OR expert_id = ?
           OR claimed_by = ?
-          OR companion_name IN (SELECT name FROM companions WHERE user_id = ? OR id = ?)
+          OR companion_name IN (SELECT name FROM companions WHERE user_id = ?)
         )
         AND ${statusWhere}
       ORDER BY created_at DESC
       ${limitSql}
-    `, [uid, uid, uid, uid, uid]);
+    `, [uid, uid, uid, uid]);
     return rows;
   }
 
@@ -1550,10 +1550,10 @@ export class MysqlRepository {
           buyer_id = ?
           OR expert_id = ?
           OR claimed_by = ?
-          OR companion_name IN (SELECT name FROM companions WHERE user_id = ? OR id = ?)
+          OR companion_name IN (SELECT name FROM companions WHERE user_id = ?)
         )
         AND ${statusWhere}
-    `, [uid, uid, uid, uid, uid]);
+    `, [uid, uid, uid, uid]);
     return Number((rows && rows[0] && rows[0].c) || 0);
   }