Add customergroup bulk reorder and list editable flag.

Expose PUT /customergroup/order for exact-set sort updates, keep create/update name-only, and mark POS/Lieferanten as non-editable in list responses.

docs/api/routes/customergroup/order.md

@@ -0,0 +1,48 @@
+# `PUT /customergroup/order`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Reorder customer groups
+
+Sets `sort` to each id’s index `0…n-1` in one transaction.
+`customergroupIds` must be exactly the company’s groups (same set, no dups)
+else `Invalid customer group order`.
+
+
+## Body (JSON)
+
+```json
+{
+  "customergroupIds": [
+    4,
+    3,
+    1,
+    2
+  ]
+}
+```
+
+## Response `200`
+
+New order
+
+```json
+{
+  "customergroupIds": [
+    1
+  ]
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Invalid customer group order or no company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._