test: 第二轮深度审计(越权隔离/引用完整性/公开面/持久化 16项, 修复4处缺陷)

src/huamenchuang/api/orders.py

@@ -133,11 +133,13 @@ async def update_order(order_id: int, body: OrderUpdate, user: CurrentUser, db:
 
 @router.delete("/{order_id}")
 async def delete_order(order_id: int, user: CurrentUser, db: DbSession):
-    """删除订单（软动作：记日志后物理删除）。"""
+    """删除订单（已完工订单拒绝）。"""
     try:
         await OrderService(db).delete_order(user, order_id)
     except KeyError as e:
         return fail(str(e))
+    except ValueError as e:
+        return fail(str(e))
     return ok(message="删除成功")