Add drag & drop reordering of trips on the dashboard

- trip_members.sort_order (per-user, migrated) drives GET /api/trips order
- PATCH /api/trips/:id/order updates only the caller's membership row
- Trip cards get a drag handle reusing the generalized row-reorder helper;
  clicking the card still navigates

docs/API.md

@@ -32,6 +32,7 @@ trips        (id INTEGER PK, name TEXT NOT NULL, start_date TEXT NOT NULL, end_d
               created_at TEXT DEFAULT current_timestamp)
 trip_members (trip_id INTEGER REFERENCES trips(id), user_id INTEGER REFERENCES users(id),
               role TEXT NOT NULL DEFAULT 'editor',  -- 'owner' | 'editor'
+              sort_order INTEGER NOT NULL DEFAULT 0, -- per-user dashboard order (drag & drop)
               PRIMARY KEY (trip_id, user_id))
 entries      (id INTEGER PK, trip_id INTEGER NOT NULL REFERENCES trips(id),
               date TEXT NOT NULL,          -- start date
@@ -150,10 +151,11 @@ User JSON shape everywhere: `{id, display_name}`.
 
 | Method & path | Body | Response |
 |---|---|---|
-| `GET /api/trips` | — | `200 {trips: [{id, name, start_date, end_date, owner_id, currency, role, member_count, entry_count}]}` (trips where user is member, newest first) |
+| `GET /api/trips` | — | `200 {trips: [{id, name, start_date, end_date, owner_id, currency, role, sort_order, member_count, entry_count}]}` (trips where user is member, ordered by the caller's `trip_members.sort_order`, then newest first for ties) |
 | `POST /api/trips` | `{name, start_date, end_date, currency?}` | `201 {trip}`; validates: name non-empty ≤120 chars, valid dates, `end_date >= start_date`, range ≤ 365 days, currency (if given) matches `^[A-Z]{3}$` (default `USD`). Creator becomes member with role `owner`. |
 | `GET /api/trips/:id` | — | `200 {trip: {id, name, start_date, end_date, owner_id, currency, join_code}, members: [{id, display_name, role}], entries: [entry…]}` entries ordered by `(date, sort_order, id)` |
 | `PATCH /api/trips/:id` | any of `{name, start_date, end_date, currency}` | `200 {trip}` (same validation; entries outside new range are kept) |
+| `PATCH /api/trips/:id/order` | `{sort_order}` | `200 {sort_order}` — updates the CALLER's own `trip_members.sort_order` for this trip (any member; integer required, else 400). Per-user: does not affect other members' dashboard order. |
 | `DELETE /api/trips/:id` | — | `204` — owner only, else `403`. Deletes members + entries too. |
 | `POST /api/trips/join` | `{code}` | `200 {trip}` — joins the trip with that join_code as `editor` (idempotent: already a member → still `200 {trip}`); `404 {"error":"not found"}` on unknown code. Code normalized like tokens (strip dashes/spaces, uppercase). |
 | `POST /api/trips/:id/join-code` | — | `200 {trip}` — regenerates join_code, owner only (`403` otherwise) |