feat(library): add ordered backlog page and up-next dashboard tile

README.md

@@ -28,9 +28,13 @@ To Be Played is split into three repositories:
 - **Coming games**: a game that is not released yet (and nobody played) shows a "Coming <date>" badge in the library, on
   the details page, in the stat game lists and on the public profile. The pile counts only the games Core sends in
   `pileGames`, so coming games are not on it; Core never picks them.
-- **What to play next** (`/play-next`): three backlog picks for a time budget (up to 5 / 15 / 40 h or any) and a mood
+- **What to play next** (`/play-next`): four backlog picks for a time budget (up to 5 / 15 / 40 h or any) and a mood
   (story, co-op, chill, action, scary from IGDB; speedrun from speedrun.com). Each pick says why: like a game you
-  played a lot, waiting longest, or random. Reroll without repeats, and "Start playing" in one click.
+  played a lot, waiting longest, random, or next in your own backlog order. Reroll without repeats, and "Start playing" in one click.
+- **Backlog order** (`/backlog`, third library tab): all backlog games in your own order. Move a game by drag (pointer
+  events, no library, so it works with touch), by the up and down buttons, or "move to top / bottom" in the menu. Each
+  move saves the whole list. The "Up next" dashboard tile shows the first games; the picker has a "next in your
+  backlog" reason.
 - **Your stats** (`/stats`): totals and statuses; the pile in hours, in weeks at your pace of the last 90 days and in
   years of full-time work, and its oldest unplayed game; most played and most loyal games; top genres and moods;
   trips to the moon, the longest gaming day, games started but under one hour; finished games per year; games per platform.
@@ -195,6 +199,7 @@ flowchart LR
     Auth -->|"check_authentication"| SteamLogin
 ```
 
+- `useDragSort` (`src/hooks/useDragSort.js`) sorts a list with pointer events. Only the drag handle has `touch-action: none`, so the page still scrolls from a row.
 - nginx serves the built app. It has no backend of its own: the browser calls Auth and Core directly
   (`VITE_API_URL`, `VITE_CORE_API_URL`). The Content Security Policy allows only these two hosts and the image hosts.
 - Auth and Core each have their own database. Core verifies Auth's tokens with Auth's public keys (JWKS).