feat: add sort by vmid, name, last created, last updated on dashboard

- GET /api/instances now accepts ?sort= (name|vmid|created_at|updated_at)
  and ?order= (asc|desc); invalid sort fields fall back to name asc
- Timestamp sorts use id as a tiebreaker (datetime() precision is 1 s)
- Toolbar gains a sort-field <select> and a ↑/↓ direction toggle button
- toggleSortDir() flips direction and re-fetches; state held in data-dir attr

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/db.js

@@ -133,6 +133,8 @@ function seedJobs() {
 
 // ── Queries ───────────────────────────────────────────────────────────────────
 
+const VALID_SORTS  = ['name', 'vmid', 'updated_at', 'created_at'];
+
 export function getInstances(filters = {}) {
   const parts = ['SELECT * FROM instances WHERE 1=1'];
   const params = {};
@@ -142,7 +144,11 @@ export function getInstances(filters = {}) {
   }
   if (filters.state) { parts.push('AND state = @state'); params.state = filters.state; }
   if (filters.stack) { parts.push('AND stack = @stack'); params.stack = filters.stack; }
-  parts.push('ORDER BY name ASC');
+  const sortField = VALID_SORTS.includes(filters.sort) ? filters.sort : 'name';
+  const sortOrder = filters.order === 'desc' ? 'DESC' : 'ASC';
+  // id is a stable tiebreaker for timestamp fields (datetime precision is 1 s)
+  const tiebreaker = (sortField === 'created_at' || sortField === 'updated_at') ? `, id ${sortOrder}` : '';
+  parts.push(`ORDER BY ${sortField} ${sortOrder}${tiebreaker}`);
   return db.prepare(parts.join(' ')).all(params);
 }