Add customergroup bulk reorder and list editable flag.

Expose PUT /customergroup/order for exact-set sort updates, keep create/update name-only, and mark POS/Lieferanten as non-editable in list responses.

docs/api/routes/customergroup/create.md

@@ -5,6 +5,9 @@ Protected. Requires a valid session cookie (`credentials: 'include'`).
 Create customer group
 
 Creates a customer group for the selected company.
+Appends with the next `sort` index. Reserved names `POS` and `Lieferanten`
+are not allowed (`Name not allowed`).
+
 
 ## Body (JSON)
 
@@ -22,7 +25,8 @@ Created customer group
 {
   "customergroup": {
     "id": 1,
-    "name": "…"
+    "name": "…",
+    "sort": 1
   }
 }
 ```
@@ -31,7 +35,7 @@ Created customer group
 
 | Status | Description |
 |--------|-------------|
-| 400 | Name required or no company selected — `{"error":"…"}` |
+| 400 | Name required, name not allowed, or no company selected — `{"error":"…"}` |
 | 401 | Unauthorized — `{"error":"…"}` |
 | 403 | Not authorized — `{"error":"…"}` |
 | 404 | Company not found — `{"error":"…"}` |

docs/api/routes/customergroup/list.md

@@ -4,7 +4,10 @@ Protected. Requires a valid session cookie (`credentials: 'include'`).
 
 List customer groups
 
-Lists customer groups for the authenticated user's selected company.
+Lists customer groups for the selected company, ordered by `sort`.
+Each item includes `editable`: `false` for implicit `POS` / `Lieferanten`
+(name locked), `true` otherwise. Reorder via `PUT /customergroup/order`.
+
 
 ## Response `200`
 
@@ -15,7 +18,9 @@ Customer group list
   "customergroups": [
     {
       "id": 1,
-      "name": "…"
+      "name": "…",
+      "sort": 1,
+      "editable": true
     }
   ]
 }

docs/api/routes/customergroup/order.md

@@ -0,0 +1,48 @@
+# `PUT /customergroup/order`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Reorder customer groups
+
+Sets `sort` to each id’s index `0…n-1` in one transaction.
+`customergroupIds` must be exactly the company’s groups (same set, no dups)
+else `Invalid customer group order`.
+
+
+## Body (JSON)
+
+```json
+{
+  "customergroupIds": [
+    4,
+    3,
+    1,
+    2
+  ]
+}
+```
+
+## Response `200`
+
+New order
+
+```json
+{
+  "customergroupIds": [
+    1
+  ]
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Invalid customer group order or no company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/customergroup/update.md

@@ -4,7 +4,9 @@ Protected. Requires a valid session cookie (`credentials: 'include'`).
 
 Update customer group
 
-Renames a customer group for the selected company.
+Renames a customer group. Implicit `POS` / `Lieferanten` cannot be
+renamed (`Name cannot be changed`). Reorder via `PUT /customergroup/order`.
+
 
 ## Path parameters
 
@@ -28,7 +30,8 @@ Updated customer group
 {
   "customergroup": {
     "id": 1,
-    "name": "…"
+    "name": "…",
+    "sort": 1
   }
 }
 ```
@@ -37,7 +40,7 @@ Updated customer group
 
 | Status | Description |
 |--------|-------------|
-| 400 | Name required, invalid id, or no company selected — `{"error":"…"}` |
+| 400 | Name required, name cannot be changed, invalid id, or no company selected — `{"error":"…"}` |
 | 401 | Unauthorized — `{"error":"…"}` |
 | 403 | Not authorized — `{"error":"…"}` |
 | 404 | Customer group or company not found — `{"error":"…"}` |