fix(backend): bound order device identifiers

[Leonard-Don]

Summary

• apply the same 3..128 character deviceId bounds to order creation as auth requests
• add backend contract coverage for too-short, too-long, and lower-boundary device ids

Validation

• python3 -m pytest backend/tests/test_backend_contract.py -q
• git diff --check origin/main..HEAD
• added-line secret/danger scan (only auth header test references)
• Claude read-only diff review: APPROVED