M2 drag-reorder: notes.position + reorder API + native DnD

- Migration 0008: notes.position (int). Board orders pinned -> position ->
  updated_at; new notes created at top (max position + 1). POST /api/notes/reorder
  assigns positions from the given order (owner-scoped).
- notes store: position on Note, position-aware sort, optimistic reorder().
- NoteCard reorderable (native HTML5 draggable + dragstart/drop); BoardView moves
  the dragged note before the drop target and persists.

Note: drag on a CSS-columns masonry has imperfect during-drag visuals (columns
reflow); order persists correctly. Candidate for a polish pass / layout tweak.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

tests/test_notes.py

@@ -68,3 +68,9 @@ async def test_upload_attachment_requires_auth(app):
     client = app.test_client()
     resp = await client.post("/api/notes/00000000-0000-0000-0000-000000000000/attachments")
     assert resp.status_code == 401
+
+
+async def test_reorder_requires_auth(app):
+    client = app.test_client()
+    resp = await client.post("/api/notes/reorder", json={"ids": []})
+    assert resp.status_code == 401