feat(create): persist ordered module resources

[kbuffardi]

Summary

• persist zero-based Module resource ordering with an explicit join model and migration
• return ordered resources through Module, course, instructor, student, and Demo-attempt read paths
• order learner Demo exercises by the existing persisted association order
• replace Module’s resource multiselect with an additive, sortable, removable list
• reject duplicate resource IDs at validation and cover that boundary with unit tests

Closes #182

Verification

• npx tsc -p api/tsconfig.app.json --noEmit
• npx tsc -p client/tsconfig.app.json --noEmit
• npx nx build api --configuration=production
• npx nx build client --configuration=production

Test limitation

The validations library has no configured Nx test target. The Cypress scenario was added, but local browser execution cannot reach the protected Create route without the API/auth service, so it times out before the form mounts.

Security note

npm audit --omit=dev --audit-level=high reports pre-existing repository-wide vulnerabilities, including a critical Sequelize advisory; no dependency changes are included in this PR.