refactor: Remove ICurrentUserService dependency from query handlers and update user ID handling logic

src/CMSMicroservice.Application/UserOrderCQ/Queries/GetCustomerOrder/GetCustomerOrderQueryHandler.cs

@@ -7,29 +7,22 @@ namespace CMSMicroservice.Application.UserOrderCQ.Queries.GetCustomerOrder;
 public class GetCustomerOrderQueryHandler : IRequestHandler<GetCustomerOrderQuery, GetCustomerOrderResponseDto>
 {
     private readonly IApplicationDbContext _context;
-    private readonly ICurrentUserService _currentUser;
 
     public GetCustomerOrderQueryHandler(
-        IApplicationDbContext context,
-        ICurrentUserService currentUser)
+        IApplicationDbContext context)
     {
         _context = context;
-        _currentUser = currentUser;
     }
 
     public async Task<GetCustomerOrderResponseDto> Handle(GetCustomerOrderQuery request, CancellationToken cancellationToken)
     {
-        // Resolve UserId from JWT if not specified
-        var userId = request.UserId == 0
-            ? (long.TryParse(_currentUser.UserId, out var currentUserId) ? currentUserId : 0)
-            : request.UserId;
-
-        if (userId == 0)
-            throw new UnauthorizedAccessException("User ID not found");
+        // UserId > 0 → filter by that user (customer security)
+        // UserId == 0 → no user filter (admin can view any order by ID)
+        var userId = request.UserId;
 
         var order = await _context.UserOrders
             .AsNoTracking()
-            .Where(x => x.Id == request.OrderId && x.UserId == userId)
+            .Where(x => x.Id == request.OrderId && (userId == 0 || x.UserId == userId))
             .Include(x => x.Package)
             .Include(x => x.Transaction)
             .Include(x => x.UserAddress)

src/CMSMicroservice.Application/UserOrderCQ/Queries/GetCustomerOrders/GetCustomerOrdersQueryHandler.cs

@@ -8,29 +8,22 @@ namespace CMSMicroservice.Application.UserOrderCQ.Queries.GetCustomerOrders;
 public class GetCustomerOrdersQueryHandler : IRequestHandler<GetCustomerOrdersQuery, GetCustomerOrdersResponseDto>
 {
     private readonly IApplicationDbContext _context;
-    private readonly ICurrentUserService _currentUser;
 
     public GetCustomerOrdersQueryHandler(
-        IApplicationDbContext context,
-        ICurrentUserService currentUser)
+        IApplicationDbContext context)
     {
         _context = context;
-        _currentUser = currentUser;
     }
 
     public async Task<GetCustomerOrdersResponseDto> Handle(GetCustomerOrdersQuery request, CancellationToken cancellationToken)
     {
-        // Resolve UserId from JWT if not specified
-        var userId = request.UserId == 0
-            ? (long.TryParse(_currentUser.UserId, out var currentUserId) ? currentUserId : 0)
-            : request.UserId;
-
-        if (userId == 0)
-            throw new UnauthorizedAccessException("User ID not found");
+        // UserId > 0 → filter by that user
+        // UserId == 0 → show ALL users (admin mode)
+        var userId = request.UserId;
 
         var query = _context.UserOrders
             .AsNoTracking()
-            .Where(x => x.UserId == userId)
+            .Where(x => userId == 0 || x.UserId == userId)
             .Include(x => x.Package)
             .Include(x => x.Transaction)
             .Include(x => x.UserAddress)