Add customergroup sort with bulk order and locked implicit names.

Reorder via customergroup.order (exact id list → sort 0…n-1); block renaming POS/Lieferanten while still allowing create/update of other groups by name.

scripts/test-api.js

@@ -164,6 +164,7 @@ const MENU = {
       { value: 'customergroup.list', label: 'list', hint: 'googleAuthId, companyId → rows' },
       { value: 'customergroup.create', label: 'create', hint: 'googleAuthId, companyId, name → row' },
       { value: 'customergroup.update', label: 'update', hint: 'googleAuthId, companyId, id, name → row' },
+      { value: 'customergroup.order', label: 'order', hint: 'googleAuthId, companyId, JSON customergroupIds → { customergroupIds }' },
       { value: 'customergroup.delete', label: 'delete', hint: 'googleAuthId, companyId, id' },
     ],
   },
@@ -799,9 +800,11 @@ async function runMethod(client, action) {
       if (name == null) return;
       return [
         'result',
-        await client.customergroup.create(Number(googleAuthId), Number(companyId), {
-          name,
-        }),
+        await client.customergroup.create(
+          Number(googleAuthId),
+          Number(companyId),
+          { name },
+        ),
       ];
     }
     case 'customergroup.update': {
@@ -825,6 +828,33 @@ async function runMethod(client, action) {
         ),
       ];
     }
+    case 'customergroup.order': {
+      const googleAuthId = await askInt('google_auth id');
+      if (googleAuthId == null) return;
+      const companyId = await askInt('company id');
+      if (companyId == null) return;
+      const idsJson = await askText('customergroupIds JSON', {
+        placeholder: '[3,1,2]',
+        validate: (v) => {
+          if (!v?.trim()) return 'Required';
+          try {
+            const parsed = JSON.parse(v);
+            if (!Array.isArray(parsed)) return 'Must be a JSON array';
+          } catch {
+            return 'Invalid JSON';
+          }
+        },
+      });
+      if (idsJson == null) return;
+      return [
+        'result',
+        await client.customergroup.order(
+          Number(googleAuthId),
+          Number(companyId),
+          { customergroupIds: JSON.parse(idsJson) },
+        ),
+      ];
+    }
     case 'customergroup.delete': {
       const googleAuthId = await askInt('google_auth id');
       if (googleAuthId == null) return;