fix(categories): address PR #790 review — event ownership, migration renumber, nits

- 🔴 Event ownership: GET /event/:eventId and DELETE /reorder/:eventId now use
  requireEventOwnership; POST /reorder (event_id in body) gets the equivalent
  inline check (super_admin bypasses; others limited to owned/ownerless events).
  New test covers a settings.edit-holding non-super_admin blocked (403) on all
  three per-event routes.
- 🔴 Migration renumber: 158→159, 159→160 (upstream #788 already took 158);
  headers + the test's require path updated.
- 🟢 Nits: stale inline "Drag the arrows" fallback → "Use the arrows" (matches
  en.json; control is click-only); invalid bg-accent-dark/150 → bg-accent-dark.

backend/migrations/core/159_add_category_display_order.js

@@ -1,5 +1,5 @@
 /**
- * Migration 158: per-event category ordering (#782).
+ * Migration 159: per-event category ordering (#782).
  *
  * Adds a `display_order` integer to `photo_categories` so photographers can
  * arrange an event's categories in the flow of the day (Pre-Ceremony →

backend/migrations/core/160_add_event_category_order.js

@@ -1,7 +1,7 @@
 /**
- * Migration 159: per-event category order override (#782).
+ * Migration 160: per-event category order override (#782).
  *
- * Builds on migration 158 (photo_categories.display_order = the GLOBAL default
+ * Builds on migration 159 (photo_categories.display_order = the GLOBAL default
  * order) by adding a per-event OVERRIDE layer. Global categories are shared
  * across every event, so a single display_order can only express one order for
  * them. This table lets a single gallery arrange its categories — globals AND