fix(core): Check order state before mutating order lines

[ayim]

Mirrored from vendurehq#3729 for the Overwatch review demo.

Original author: @ronakmaheshwari

---

Description

This PR ensures that the order state is checked and transitioned to 'Modifying' before any order lines are created or mutated via addItemsToOrder.

Breaking changes

This PR only changes internal flow control within OrderService.addItemsToOrder and does not affect external API behavior or existing API consumers.

Screenshots

N/A – this is a backend logic fix and does not affect the UI.

Checklist

📌 Always:

• I have set a clear title
• My PR is small and contains a single feature
• I have checked my own PR

👍 Most of the time:

• I have added or updated test cases
• I have updated the README if needed

Summary by CodeRabbit

• Bug Fixes
  • Improved validation to ensure items can only be added to orders in the correct state, with clear error messaging if not allowed.
  • Enhanced handling of custom fields and item quantities when adding items to an order.
  • Ensured the order reflects all latest changes after items are added.

[overwatch-pr]

Overwatch risk assessment: HUMAN REVIEW

Reviewed commit: bcc38c8820bf58d27b979625d8d2f89350056f0c
Decision: Require an owner review before merge

The diff is contained to 1 file and 109 changed lines, but it mutates the active-order path used by checkout.

Evidence

• Same-file history: Vendure PR #4928 changed packages/core/src/service/services/order.service.ts. A human reviewer flagged a stale checkout assumption in that implementation.
• Related implementation: Vendure PR fix(core): apply pessimistic locking to prevent order modification race conditions #3398 vendurehq/vendure#4071 also changes the same OrderService file and discusses order-mutation concurrency.
• Runtime exposure: New Relic observed 2,740 requests to POST /shop-api in 24h, with 214 ms p95 latency and 0 route errors when assessed.
• Incident memory: Two controlled New Relic demo incidents are correlated with this checkout path. These are synthetic demo incidents, not production failures caused by this PR.
• Component path: Checkout → POST /shop-api → OrderService → order.service.ts.

Required before approval

1. An OrderService owner should verify the state transition and rollback behavior.
2. Required CI checks should pass for the reviewed commit.

Overwatch correlates repository history and live operational evidence. Runtime signals are path-level context; they are not direct attribution to this commit.