Request Flow

Next.js checkout  POST /api/v1/orders  (Bearer token, Idempotency-Key)
   |
   v
helmet, CORS, RequestIdMiddleware, LoggerMiddleware
   |
   v
ThrottlerGuard -> JwtAuthGuard (verify token, req.user) -> RolesGuard (customer)
   |
   v
TimingInterceptor -> IdempotencyInterceptor (seen key? replay)
   |
   v
ValidationPipe: CreateOrderDto (items[], address, paymentMethod)
   |
   v
OrdersController.create(@CurrentUser() user, dto)
   |
   v
OrdersService.place()
   ├── prisma.$transaction: decrement stock (atomic), create Order + OrderItems
   ├── PaymentsService.createRazorpayOrder()  -> razorpayOrderId
   └── emit "order.created"  -> BullMQ: email + SMS jobs
   |
   v
TransformInterceptor -> 201 {"success":true,"data":{"id":"ORD-7781","razorpayOrderId":"order_N8k..","total":"2598.00"}}

Later:  Razorpay webhook -> verify signature -> order PAID -> OrdersGateway.emitStatus() -> customer's screen updates
Errors anywhere -> AllExceptionsFilter / PrismaExceptionFilter -> {"success":false,"error":{...}}