Implement ordering MVP domain layer per spec (issue #1)

Scaffolds the TanStack Start + Drizzle/Postgres + Better Auth app and
implements the core ordering domain: menu browsing, guest/account order
placement with online payment, per-Order-Item independent cooking and
cancellation, dynamic Machine-Tag pool assignment, and multi-step recipes
(see docs/adr/0001-0003). Adds a guest-access-token / session-based
ownership check on every read/mutation so an order can't be viewed,
cancelled, or picked up by anyone but its owner.

Covered by 14 tests running the domain layer directly against a real,
ephemeral Postgres (testcontainers) — createServerFn couldn't be called
outside a real request context, so tests exercise the domain functions the
server functions thinly wrap instead of the server functions themselves.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/helpers/test-db.ts

@@ -0,0 +1,42 @@
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { PostgreSqlContainer } from '@testcontainers/postgresql'
+import type { StartedPostgreSqlContainer } from '@testcontainers/postgresql'
+import { drizzle } from 'drizzle-orm/node-postgres'
+import type { NodePgDatabase } from 'drizzle-orm/node-postgres'
+import { migrate } from 'drizzle-orm/node-postgres/migrator'
+
+import * as schema from '#/db/schema.ts'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const migrationsFolder = path.resolve(__dirname, '../../drizzle')
+
+export type TestDatabase = {
+  db: NodePgDatabase<typeof schema>
+  connectionUri: string
+  stop: () => Promise<void>
+}
+
+// A real, ephemeral Postgres per test file, per the spec's testing
+// decisions: no in-memory fake, no mocked Drizzle client.
+export const startTestDatabase = async (): Promise<TestDatabase> => {
+  const container: StartedPostgreSqlContainer = await new PostgreSqlContainer(
+    'postgres:16-alpine',
+  ).start()
+
+  const connectionUri = container.getConnectionUri()
+  const db = drizzle(connectionUri, { schema })
+  await migrate(db, { migrationsFolder })
+
+  return {
+    db,
+    connectionUri,
+    stop: async () => {
+      // End the pg Pool before tearing down the container, or a pending
+      // connection emits an unhandled "terminating connection" error.
+      await db.$client.end()
+      await container.stop()
+    },
+  }
+}