feat(hosts): add drag-and-drop and global subscription ordering (#6895)

Hosts already had one saved order on the Hosts page, but subscriptions honoured
it only inside each inbound, so a host of a later inbound could never come before
one of an earlier inbound (#6894). A new opt-in setting makes raw/base64,
Clash/Mihomo and JSON subscriptions follow the Hosts page order across inbounds;
the default keeps today's inbound-first output unchanged. The Hosts table gains
drag-and-drop reordering next to the Up/Down buttons, on a pointer-reorder hook
the Routing Rules table now shares.

docs/content/docs/en/config/subscription.mdx

@@ -51,7 +51,7 @@ The **format is chosen by path**, each with its own enable toggle:
 | **Clash for Windows (legacy)** | `/clash-legacy/` | `subClashEnable` | YAML limited to proxy types, transports, and ciphers supported by the legacy Clash core. |
 
 Only enabled inbounds using **VLESS, VMess, Trojan, Shadowsocks, WireGuard, AmneziaWG, MTProto, TUIC, or Hysteria2**
-appear in a subscription, ordered by their sub-sort index (TUIC and AmneziaWG are included in raw links and Clash/Mihomo profiles, but omitted from JSON endpoints; MTProto is included in raw links). Requesting `subPath`
+appear in a subscription, ordered by their sub-sort index by default (TUIC and AmneziaWG are included in raw links and Clash/Mihomo profiles, but omitted from JSON endpoints; MTProto is included in raw links). Requesting `subPath`
 with an `Accept: text/html` header (or `?html=1`) returns a human-readable info
 page instead of the raw body.
 
@@ -74,6 +74,42 @@ default matcher so existing subscription URLs continue returning YAML.
 It does not distinguish legacy clients from Mihomo-based clients; Clash for
 Windows users must use `/clash-legacy/<sub-id>` for a compatible profile.
 
+### Subscription node ordering
+
+In **Settings → Subscription → Panel settings**, select **Subscription Node Ordering**
+(`subHostSortMode`). **Inbound order (default)** preserves the existing subscription
+sort index, then inbound ID, with each inbound's Hosts ordered inside that block.
+
+**Hosts order** (`hosts-first`) uses the global order on **Hosts**, including Host
+groups attached to different inbounds. Drag a group's grip above or below another
+row to save its position, or use the existing Up/Down buttons. A failed save restores
+the previous displayed order. The next subscription fetch uses the saved order;
+no inbound edit or Xray restart is needed.
+
+For example, these rows start with Host A (Inbound #5) above Host B (Inbound #20):
+
+![Hosts before reordering, with Host A above Host B](/images/hosts-order-before.png)
+
+Dragging Host B above Host A saves the order across both inbounds:
+
+![Hosts after reordering, with Host B above Host A](/images/hosts-order-after.png)
+
+These screenshots use example Hosts and synthetic API responses.
+
+Host groups sort by their persisted sort order. Ties use the group remark and group
+ID, matching the Hosts table. Within a group, inbound subscription sort index,
+inbound ID and Host row ID provide deterministic ordering for attachments and
+addresses. Inbounds without applicable Hosts and legacy externalProxy entries
+follow all Host entries in their previous relative order. External client links
+remain appended, and the subscription info node remains first.
+
+This applies to Raw/Base64, Clash/Mihomo and JSON subscriptions. JSON balancer
+documents keep their slots from the existing numeric balancer/inbound sort; only
+the endpoint slots are rearranged, preserving the relative order of Host entries.
+Eligibility, exclusions, credentials and protocol settings are unchanged.
+Standalone share-link and QR previews retain their existing behavior. Client apps
+may apply their own sorting after importing a subscription.
+
 ### Base64 vs JSON
 
 The **Base64** body is just the newline-joined share links, standard-base64