Retrieve a single order by its order_number for the
authenticated store. The optional # prefix is normalised — both
#1001 and 1001 resolve to the same order.

Cross-store lookups return 404, never 403 (we never reveal that
an order exists on a different store).

This endpoint includes line_items in the response (unlike list
endpoints which omit them for payload size).