Improvements

UnitPrice of OrderLine shouldn't be part of the API call, it should be looked up in DB based on ProductName (or even better an id).

Separate domain models from API. Right now we need to consider the shape of the API when updating the "domain" models.

Document all response types and status codes in the OpenAPI specification.

CancellationTokens are never a bad idea.

Use an injected TimeProvider. This will help reduce flakey unit tests as the tests no longer rely on actual wall time.

Non of the OrderServiceTests are very interesting, because there's no interesting logic in the OrderService.