Hello Mirko. Thanks for all the details!
Correct me if I'm wrong. Your "process-api-orders" app is using the "@elastic/elasticsearch" client. From your details it looks like the "403 Forbidden" error is from you app talking to Elasticsearch (a service on port 9200), rather than from the APM Agent in your app talking to the apm-server (a service on port 8200).
Is it possible you are using the API key generated by apm-server apikey ... to talk to Elasticsearch? My (inexperienced) understanding is that that API key is only for the APM Agent to talk to the apm-server. The auth parameters for using the "@elastic/elasticsearch" client to talk to Elasticsearch would be different.
Cheers,
Trent