fix: reject change requests for dealless orders

[garvitkaushik-123]

Summary

• normalize omitted order deal IDs to an empty string instead of persisting null
• reject change requests for orders without a deal reference using a structured HTTP 400 response
• guard legacy records where deal_id is already null before constructing the change-request model

Why

Orders created without a deal ID are valid through the public orders endpoint, but requesting a change against one passed null into the ChangeRequest model and raised an uncaught validation error. That surfaced as an unstructured HTTP 500.

The write-side normalization prevents new null records, while the read-side check protects records already stored with the old shape.

Testing

• verifies new dealless orders persist an empty deal ID
• verifies a legacy order with a null deal ID returns deal_id_required with HTTP 400
• verifies the rejected request does not create a change-request record
• full suite: 1,480 passed, 28 skipped
• changed-file lint, formatting, and whitespace checks pass

Closes #61