feat(17-01): tree reorder page and singleton admin controllers

- cabana: config_reorder.yaml (title, nameFrom, modelClass, parentColumn,
  sortColumn, maxDepth, partition) with fail-loud boot checks and the
  built-in reorder toolbar button; list schema carries reorder
- GET/POST {controller}/reorder: scoped set (ListExtendQuery plus the
  partition) locked FOR UPDATE, 409 reorder_stale on any set difference,
  422 for duplicates, foreign parents, cycles and maxDepth, both columns
  written without model hooks
- pact.AdminSingleton: GET {controller}/singleton (first or create, form
  scope checked), form schema singleton, list/create/bulk/delete 404,
  no config_list.yaml needed
- swag, inventories, token classes, CSRF walk, conformance cases, backend
  lang reorder.stale and load_failed, reorder and singleton smoke tests, docs

modules/cabana/security_coverage_test.go

@@ -63,6 +63,9 @@ var phase09Routes = []adminRoute{
 	{key: "GET /{vendor}/{plugin}/{controller}"},
 	{key: "POST /{vendor}/{plugin}/{controller}"},
 	{key: "POST /{vendor}/{plugin}/{controller}/bulk-delete"},
+	{key: "GET /{vendor}/{plugin}/{controller}/reorder"},
+	{key: "POST /{vendor}/{plugin}/{controller}/reorder"},
+	{key: "GET /{vendor}/{plugin}/{controller}/singleton"},
 	{key: "POST /{vendor}/{plugin}/{controller}/bulk/{action}"},
 	{key: "POST /{vendor}/{plugin}/{controller}/widgets/{field}"},
 	{key: "POST /{vendor}/{plugin}/{controller}/toolbar/{action}"},
@@ -318,6 +321,9 @@ func phase09ProtectedCalls() []phase09Call {
 		{"relation-linked", (*service).relationLinked},
 		{"field-options", (*service).fieldOptions},
 		{"dependent-options", (*service).dependentOptionsRoute},
+		{"reorder-get", (*service).reorderGet},
+		{"reorder-post", (*service).reorderPost},
+		{"singleton", (*service).singletonRoute},
 		{"filter-options", (*service).filterOptions},
 		{"nested-get", (*service).nestedGet},
 		{"relation-candidates", (*service).relationCandidates},