fix(categories): address PR #790 review — event ownership, migration renumber, nits

- 🔴 Event ownership: GET /event/:eventId and DELETE /reorder/:eventId now use
  requireEventOwnership; POST /reorder (event_id in body) gets the equivalent
  inline check (super_admin bypasses; others limited to owned/ownerless events).
  New test covers a settings.edit-holding non-super_admin blocked (403) on all
  three per-event routes.
- 🔴 Migration renumber: 158→159, 159→160 (upstream #788 already took 158);
  headers + the test's require path updated.
- 🟢 Nits: stale inline "Drag the arrows" fallback → "Use the arrows" (matches
  en.json; control is click-only); invalid bg-accent-dark/150 → bg-accent-dark.

backend/src/utils/categoryOrder.js

@@ -4,7 +4,7 @@
  * Resolves an event's categories into their effective display order, layering:
  *   1. per-event override — event_category_order.position, when the event has
  *      been customised;
- *   2. the global default — photo_categories.display_order (migration 158);
+ *   2. the global default — photo_categories.display_order (migration 159);
  *   3. name.
  *
  * Globals and event-specific categories are ordered together so a custom order