Cancel an order (synchronous)

Cancels an order as a CANCELLED transition validated by the order state machine version pinned at creation. A required free-text reason plus any free-form metadata are captured on an immutable timeline event (OrderTrackingEvent — the cancellation moment is previousStatus; the server-validated reason always wins over a same-named metadata key) and echoed back in the response metadata. The transition and the event are written in a single transaction. Orders past INVOICED have no declared edge to CANCELLED and are rejected with 422. accountCode and the actor (user or service account) come from the JWT.