Refactor ordersRoute to include targetCustomerNumber in permission checks

- Use `resolveEffectiveCustomerNumber` for determining customer context.
- Adjust own/department access logic and remove unnecessary casting for `customer_id`.

services/nginx/app/routes/ordersRoute.php

@@ -40,10 +40,11 @@ class ordersRoute
             $permission_own = self::definePermission('list_own_orders', subusers_permission_node_key::ORDERS_LIST);
             $permission_other = self::definePermission('list_orders');
             $has_permission_other = self::hasPermission($permission_other);
+            $targetCustomerNumber = self::resolveEffectiveCustomerNumber();
             self::allowOwnOrDepartmentAccess(
                 $permission_own,
                 $permission_other,
-                null,
+                $targetCustomerNumber,
                 null,
                 null,
                 'You do not have permission to list orders.'
@@ -112,7 +113,7 @@ class ordersRoute
                             'department_id' => $department_ids
                         ] : []),
                         ...(!$has_permission_other && $effectiveCustomer !== null ? [
-                            'customer_id' => [(int)$effectiveCustomer]
+                            'customer_id' => $effectiveCustomer
                         ] : []),
                     ])
                 )