feat: drag-and-drop node reordering in the admin panel

Matches Remnawave/Marzban's 'Host Sorting via Web UI' — was the one
concrete UI gap flagged in the comparison research. Nodes get a
persistent sort_order column (backfilled once from the existing
de1-first/created_at order on migration, verified idempotent — re-running
_migrate() on an already-migrated db does not reshuffle it back).

Plain HTML5 drag-and-drop (dragstart/dragover/drop), no library —
matches the project's no-frameworks admin.html. Drop reorders the
in-memory list optimistically, re-renders immediately, then persists
via POST /admin/api/nodes/reorder; a failed save reloads from the
server instead of leaving the UI out of sync with the db.

db.reorder_nodes() rejects any list that doesn't contain exactly the
current set of node codes (no silent drops or duplicates). New nodes
append at the end (MAX(sort_order)+1) instead of jumping to the front.

Verified with a full test: initial order, reorder, two rejected
malformed reorders, a new node appending at the end, and migration
re-run not touching an already-backfilled order.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

api.py

@@ -742,6 +742,19 @@ def admin_nodes(request: Request):
     return nodes
 
 
+@app.post("/admin/api/nodes/reorder")
+def admin_reorder_nodes(request: Request, body: dict = Body(...)):
+    require_admin(request)
+    codes = body.get("codes")
+    if not isinstance(codes, list) or not codes:
+        raise HTTPException(400, "codes must be a non-empty list")
+    try:
+        db.reorder_nodes(codes)
+    except ValueError as e:
+        raise HTTPException(400, str(e))
+    return {"ok": True}
+
+
 @app.post("/admin/api/nodes")
 def admin_create_node(request: Request, body: dict = Body(...)):
     require_admin(request)