refactor: Remove ICurrentUserService dependency from query handlers and update user ID handling logic

src/CMSMicroservice.WebApi/Services/UserOrderService.cs

@@ -101,7 +101,7 @@ public class UserOrderService : UserOrderContract.UserOrderContractBase
         var query = new GetCustomerOrderQuery
         {
             OrderId = request.Id,
-            UserId = 0 // از JWT دریافت می‌شود
+            UserId = 0 // Admin: no user filter, can view any order by ID
         };
 
         var result = await _sender.Send(query, context.CancellationToken);
@@ -582,9 +582,14 @@ public class UserOrderService : UserOrderContract.UserOrderContractBase
     
     public override async Task<GetAllUserOrderByFilterResponse> GetCustomerOrders(GetAllUserOrderByFilterRequest request, ServerCallContext context)
     {
+        // Customer endpoint: ALWAYS resolve userId from JWT (customer can only see own orders)
+        var customerUserId = long.TryParse(_currentUserService.UserId, out var uid) ? uid : 0;
+        if (customerUserId == 0)
+            throw new RpcException(new Status(StatusCode.Unauthenticated, "کاربر احراز هویت نشده است"));
+
         var query = new GetCustomerOrdersQuery
         {
-            UserId = request.Filter?.UserId ?? 0,
+            UserId = customerUserId,
             PaginationState = request.PaginationState?.Adapt<AppModels.PaginationState>(),
             PaymentStatusFilter = request.Filter?.PaymentStatus != null
                 ? (int?)request.Filter.PaymentStatus
@@ -652,10 +657,15 @@ public class UserOrderService : UserOrderContract.UserOrderContractBase
     
     public override async Task<GetUserOrderResponse> GetCustomerOrder(GetUserOrderRequest request, ServerCallContext context)
     {
+        // Customer endpoint: ALWAYS resolve userId from JWT (customer can only see own orders)
+        var customerUserId = long.TryParse(_currentUserService.UserId, out var uid) ? uid : 0;
+        if (customerUserId == 0)
+            throw new RpcException(new Status(StatusCode.Unauthenticated, "کاربر احراز هویت نشده است"));
+
         var query = new GetCustomerOrderQuery
         {
             OrderId = request.Id,
-            UserId = 0 // از JWT دریافت می‌شود
+            UserId = customerUserId
         };
 
         var result = await _sender.Send(query, context.CancellationToken);