feat(labs): let a person order the lab categories (#1349)

The labs list layout gains categoryOrder, a bounded allow-list of
category keys (200 entries, 64 characters each, deduplicated, malformed
values dropped on read). GET /api/labs/overview reads the caller's own
layout and answers categories already in that order, so every client
renders them as given. Listed categories come first; keys the data does
not have are ignored; a category the order does not name follows in
the default order (catalog panels, then the person's own by label, then
other). Other left at the end of the order stays last, behind any
category added later; moved anywhere else, it stays there.

Settings > Arrangement > Labs shows a category order card while
categories are on. It lists the overview's categories under their
localised labels, sends the whole order after every move, moves the
cached overview at once and refetches it. The card says how the default
order works. The OpenAPI document carries the new field.

src/app/api/settings/module-list-layout/route.ts

@@ -58,14 +58,15 @@ export const GET = apiHandler(async () => {
 export const PUT = apiHandler(async (request: Request) => {
   const { user } = await requireActorAuth();
 
-  // 500 ids of up to 64 characters plus the envelope.
+  // 500 ids plus 200 category keys of up to 64 characters, plus the envelope.
   const parsed = await parseJsonBody(request, moduleListLayoutPutSchema, {
-    maxBytes: 48 * 1024,
+    maxBytes: 64 * 1024,
     action: "settings.module-list-layout.validation-failed",
   });
   if (!parsed.ok) return parsed.error;
 
-  const { list, view, order, sortDir, groupBy, groupsOpen } = parsed.data;
+  const { list, view, order, sortDir, groupBy, groupsOpen, categoryOrder } =
+    parsed.data;
   // Preserve-when-absent: one stored read fills whichever field the body
   // left out, and every other list stays as stored. Only fields a person has
   // chosen are written, so a field never picked keeps following the default.
@@ -79,6 +80,7 @@ export const PUT = apiHandler(async (request: Request) => {
       ...(sortDir ? { sortDir } : {}),
       ...(groupBy ? { groupBy } : {}),
       ...(groupsOpen ? { groupsOpen } : {}),
+      ...(categoryOrder ? { categoryOrder: [...new Set(categoryOrder)] } : {}),
     };
     const next = { ...stored, [list]: nextChoices };
     await tx.user.update({
@@ -98,6 +100,7 @@ export const PUT = apiHandler(async (request: Request) => {
       groupBy: layout.lists[list].groupBy,
       groupsOpen: layout.lists[list].groupsOpen,
       orderLength: layout.lists[list].order.length,
+      categoryOrderLength: layout.lists[list].categoryOrder.length,
     },
   });
   return apiSuccess(layout);