Add POST /category/:id/move to relocate a category.

Wires up the existing category.move store method (validates source and
target in the same company, rejects self/descendant cycles, assigns the
next sibling sort) behind an authenticated HTTP route, plus @openapi
docs and regenerated API docs.

docs/api/routes/category/move.md

@@ -0,0 +1,48 @@
+# `POST /category/{id}/move`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Move category to a new parent
+
+Moves a category to a new parent. Both source and target must be in
+the same authorized company. Moving into itself or into a descendant
+(cycle) fails with `Invalid parent`. The moved category gets the next
+sibling `sort` under the new parent.
+
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer | Category id to move |
+
+## Body (JSON)
+
+```json
+{
+  "parentId": 3
+}
+```
+
+## Response `200`
+
+Moved category
+
+```json
+{
+  "category": { … }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Invalid parent — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Category not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._