feat(create): persist ordered module resources

[kbuffardi]

Summary

• persist zero-based Module resource ordering with an explicit join model and migration
• return ordered resources through Module, course, instructor, student, and Demo-attempt read paths
• order learner Demo exercises by the existing persisted association order
• replace Module resource multiselect with an additive, sortable, removable list
• reject duplicate resource IDs at validation
• correct Demo drag direction after the editor update from fix demo exercise ordering #174 #179

Closes #182

Verification

• API regression tests cover Module resource create, update, and retrieval order
• API route regression test covers learner Demo exercise order
• unit test covers immutable drag reordering and direction
• Cypress scenarios cover Module reorder, Module removal, and Demo save/reopen ordering
• npx tsc -p api/tsconfig.app.json --noEmit
• npx tsc -p client/tsconfig.app.json --noEmit
• npx nx build api --configuration=production
• npx nx build client --configuration=production

Security note

npm audit --omit=dev --audit-level=high previously reported repository-wide vulnerabilities, including a critical Sequelize advisory; no dependency changes are included in this PR.