feat(17-01): tree reorder page and singleton admin controllers

- cabana: config_reorder.yaml (title, nameFrom, modelClass, parentColumn,
  sortColumn, maxDepth, partition) with fail-loud boot checks and the
  built-in reorder toolbar button; list schema carries reorder
- GET/POST {controller}/reorder: scoped set (ListExtendQuery plus the
  partition) locked FOR UPDATE, 409 reorder_stale on any set difference,
  422 for duplicates, foreign parents, cycles and maxDepth, both columns
  written without model hooks
- pact.AdminSingleton: GET {controller}/singleton (first or create, form
  scope checked), form schema singleton, list/create/bulk/delete 404,
  no config_list.yaml needed
- swag, inventories, token classes, CSRF walk, conformance cases, backend
  lang reorder.stale and load_failed, reorder and singleton smoke tests, docs

modules/pact/capabilities.go

@@ -678,6 +678,17 @@ type HasMenuItemTypes interface {
 	MenuItemTypes() []MenuItemType
 }
 
+// AdminSingleton is implemented by an admin controller that edits exactly one
+// record, such as a site-wide definition opened from the settings page.
+// SingletonRecord returns that record, creating it first when it does not
+// exist yet (first or create), using db, the request's transaction. The admin
+// framework then opens the record's form directly; the controller's list,
+// create, bulk and delete routes answer 404, and it needs no
+// config_list.yaml.
+type AdminSingleton interface {
+	SingletonRecord(ctx context.Context, db *gorm.DB) (any, error)
+}
+
 // ListExtendQuery optionally narrows the admin list query.
 type ListExtendQuery interface {
 	ListExtendQuery(ctx context.Context, db *gorm.DB) *gorm.DB