Challenge 2: Protect a Route Group — Possible Solution
====================================================================

// routes/web.php

use App\Http\Controllers\OrderController;

Route::middleware('auth')->prefix('orders')->group(function () {
    Route::get('/', [OrderController::class, 'index'])->name('orders.index');
    Route::post('/', [OrderController::class, 'store'])->name('orders.store');
});

WHAT HAPPENS FOR AN ANONYMOUS REQUEST
------------------------------------------
When an anonymous (not logged-in) visitor requests /orders, Laravel's
'auth' middleware intercepts the request before OrderController::index()
ever runs. By default, it redirects the visitor to the named route
'login' (Breeze generates this route as part of its installation) with
an HTTP 302 response:

    HTTP/1.1 302 Found
    Location: /login

This is functionally identical to Django's @login_required behavior from
Course 1 of the Django project — an unauthenticated request never
reaches the actual route handler; it's redirected to a login page
instead, and (if Breeze's default LoginRequest is used) redirected back
to the originally requested page after a successful login, via the
redirect()->intended(...) pattern seen in this chapter's example.

WHY THIS WORKS
--------------
- Route::middleware('auth')->prefix('orders')->group(...) chains BOTH the
  middleware assignment and the prefix onto the same group — Laravel's
  fluent route-building methods can be combined in any order before
  ->group(...), applying every one of them to every route defined inside
  the closure.
- Because 'auth' is applied to the GROUP rather than each individual
  route inside it, adding a third route to this /orders group later
  automatically inherits the same authentication requirement — there's
  no risk of forgetting to add ->middleware('auth') to a route added
  later, since the group itself is what carries that requirement.
- This directly reuses the exact route-grouping syntax from Course 1's
  Chapter 2 (Route::prefix()->group()) and Chapter 8's middleware
  scoping challenge — the same building blocks, just combined together
  for a real authentication requirement instead of a custom middleware.