Add test coverage for the orders-overview and order-entity access policies

A pre-alpha audit found the module in good shape (clean phpcs and phpstan, complete config schema, no deprecated APIs, a fully translated French .po), with one gap worth closing before the release: the orders access policies had no test coverage.

This adds discriminating kernel tests for the two order access policies:

• OrderOverviewAccess, the shared policy both the native overview controller and the optional Views page delegate to: a site admin and a tenant order manager are allowed, and a user with neither is denied, so the list is not open to any authenticated user.
• OrderAccessControlHandler: admins and tenant order managers may view and update a tenant order while a stranger may not; and the delete guard (which applies to everyone, admins included) refuses to purge an order unless it is archived or cancelled, and only within its own tenant.

Each assertion flips between allowed and forbidden on the exact condition, so a regression that dropped a guard, such as deleting a live order or another tenant order, fails the test.

Follow-up: ResourceScopedAccessControlHandler (yoyaku_manager) is a thin wrapper over the already-tested resource-access resolver; adding its own coverage, the admin-only resource-create rule especially, is a recommended fast-follow.