fix(backend): move procedimentos/reorder before /:id to prevent route shadowing

Express matches routes in registration order. PUT /procedimentos/:id was
registered before /procedimentos/reorder, causing 'reorder' to be captured
as an id param and the reorder endpoint to be unreachable.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/server.js

@@ -895,6 +895,20 @@ app.post('/api/procedimentos', async (req, res) => {
     }
 });
 
+app.put('/api/procedimentos/reorder', async (req, res) => {
+    const { orders } = req.body; // Array of {id, ordem}
+    try {
+        await withTransaction(async (client) => {
+            for (const item of orders) {
+                await client.query('UPDATE procedimentos SET ordem = $1 WHERE id = $2', [item.ordem, item.id]);
+            }
+        });
+        res.json({ success: true });
+    } catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+
 app.put('/api/procedimentos/:id', async (req, res) => {
     try {
         const { valoresPlanos, ...proc } = req.body;
@@ -917,20 +931,6 @@ app.put('/api/procedimentos/:id', async (req, res) => {
     }
 });
 
-app.put('/api/procedimentos/reorder', async (req, res) => {
-    const { orders } = req.body; // Array of {id, ordem}
-    try {
-        await withTransaction(async (client) => {
-            for (const item of orders) {
-                await client.query('UPDATE procedimentos SET ordem = $1 WHERE id = $2', [item.ordem, item.id]);
-            }
-        });
-        res.json({ success: true });
-    } catch (err) {
-        res.status(500).json({ error: err.message });
-    }
-});
-
 app.delete('/api/procedimentos/:id', async (req, res) => {
     try {
         await pool.query('DELETE FROM procedimentos WHERE id = $1', [req.params.id]);