test: add failing tests for sort/order on GET /api/instances

Tests cover:
- sort by vmid asc/desc
- sort by name desc
- sort by created_at asc/desc (id tiebreaker for same-second inserts)
- sort by updated_at asc/desc (id tiebreaker for same-second inserts)
- invalid sort field falls back to name asc

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/api.test.js

@@ -74,6 +74,54 @@ describe('GET /api/instances', () => {
     expect(res.body).toHaveLength(1)
     expect(res.body[0].name).toBe('plex')
   })
+
+  it('sorts by vmid ascending', async () => {
+    await request(app).post('/api/instances').send({ ...base, vmid: 200, name: 'b' })
+    await request(app).post('/api/instances').send({ ...base, vmid: 100, name: 'a' })
+    const res = await request(app).get('/api/instances?sort=vmid&order=asc')
+    expect(res.body[0].vmid).toBe(100)
+    expect(res.body[1].vmid).toBe(200)
+  })
+
+  it('sorts by vmid descending', async () => {
+    await request(app).post('/api/instances').send({ ...base, vmid: 100, name: 'a' })
+    await request(app).post('/api/instances').send({ ...base, vmid: 200, name: 'b' })
+    const res = await request(app).get('/api/instances?sort=vmid&order=desc')
+    expect(res.body[0].vmid).toBe(200)
+    expect(res.body[1].vmid).toBe(100)
+  })
+
+  it('sorts by name descending', async () => {
+    await request(app).post('/api/instances').send({ ...base, vmid: 1, name: 'alpha' })
+    await request(app).post('/api/instances').send({ ...base, vmid: 2, name: 'zebra' })
+    const res = await request(app).get('/api/instances?sort=name&order=desc')
+    expect(res.body[0].name).toBe('zebra')
+    expect(res.body[1].name).toBe('alpha')
+  })
+
+  it('sorts by created_at desc — id tiebreaker preserves insertion order', async () => {
+    await request(app).post('/api/instances').send({ ...base, vmid: 1, name: 'first' })
+    await request(app).post('/api/instances').send({ ...base, vmid: 2, name: 'second' })
+    const res = await request(app).get('/api/instances?sort=created_at&order=desc')
+    expect(res.body[0].name).toBe('second')  // id=2 before id=1
+    expect(res.body[1].name).toBe('first')
+  })
+
+  it('sorts by updated_at desc — id tiebreaker preserves insertion order', async () => {
+    await request(app).post('/api/instances').send({ ...base, vmid: 1, name: 'a' })
+    await request(app).post('/api/instances').send({ ...base, vmid: 2, name: 'b' })
+    const res = await request(app).get('/api/instances?sort=updated_at&order=desc')
+    expect(res.body[0].name).toBe('b')  // id=2 before id=1
+    expect(res.body[1].name).toBe('a')
+  })
+
+  it('ignores invalid sort field and falls back to name asc', async () => {
+    await request(app).post('/api/instances').send({ ...base, vmid: 1, name: 'zebra' })
+    await request(app).post('/api/instances').send({ ...base, vmid: 2, name: 'alpha' })
+    const res = await request(app).get('/api/instances?sort=bad_field')
+    expect(res.status).toBe(200)
+    expect(res.body[0].name).toBe('alpha')
+  })
 })
 
 // ── GET /api/instances/stacks ─────────────────────────────────────────────────