fix: harden week-two ordering, artwork and operations

app/api/orders.py

@@ -26,8 +26,8 @@ def dev_paid(body: Pay, session_id=Depends(owner)):
             quote = payments.approved_quote(c, body.quote_id, session_id)
         except payments.PaymentRefused as refusal:
             # The quote may already be paid; that is not a refusal.
-            existing = c.execute('SELECT * FROM dtf_local.orders WHERE quote_id=%s',
-                                 (body.quote_id,)).fetchone()
+            existing = c.execute('SELECT * FROM dtf_local.orders WHERE quote_id=%s AND owner=%s',
+                                 (body.quote_id, session_id)).fetchone()
             if existing:
                 return existing
             raise HTTPException(404 if 'not found' in str(refusal) else 409, str(refusal))