Add list-all orders endpoint for the admin orders view

[CarsonL15]

Summary

Adds an admin-facing "list all orders" capability to the Order Service so the Admin & Maintenance App can show every order (issue #53). Today GET /api/orders requires a customerId; an admin has no way to list orders across customers.

Change

GET /api/orders — customerId is now optional:

• omitted → returns all orders (newest first)
• provided → unchanged, returns that customer's history

Backward compatible: the customer web app's existing ?customerId= calls behave exactly as before.

• OrdersController.GetOrders branches on whether customerId is supplied
• IOrderService.GetAllOrdersAsync + implementation (no WHERE CustomerId filter)

Relates to #53 (consumed by the admin Orders view).

[CarsonL15]

Consolidating into the Sprint 3 PR instead — both pipelines still trigger by path filter on merge.