Order creation stores correct initial state

Orders created with the wrong initial state silently corrupt the state machine before a customer's first interaction. A guest checkout that creates orders as 'confirmed' and a webhook handler that creates them as 'processing' mean neither flow is correct — downstream transitions fire against the wrong base state, confirmation emails may trigger prematurely, inventory may decrement twice, and support staff see misleading history. CWE-841 (Improper Enforcement of Behavioral Workflow) applies directly: the system has an intended sequence, and this defect breaks it at step zero.

Centralize all order creation behind a single function in lib/orders/create.ts that enforces the initial status via a named constant. Import it in every creation path — checkout route, webhook handler, admin creation — so the initial state can never diverge.

// lib/orders/constants.ts
export const ORDER_INITIAL_STATUS = 'pending' as const

// lib/orders/create.ts
import { ORDER_INITIAL_STATUS } from './constants'

export async function createOrder(data: CreateOrderInput) {
  return db.orders.create({
    data: { ...data, status: ORDER_INITIAL_STATUS },
  })
}