In the domain model or the application service that places the order
Business rules belong in the domain or application layer. There, you can test them without HTTP or a database, and every entry point reuses them.
Why the other places are wrong:
• "In the controller, right after validating the request body": a queue consumer or a CLI that calls the same use case would skip the rule.
• "In the repository's save method" or "In a database trigger": these hide a business rule inside infrastructure code, where it is hard to find and test.