GET /recipes needs configurable sorting

Right now every GET /recipes response comes back sorted by id -- i.e. by insertion order -- no matter what the caller wants. A frontend that wants to show "quickest recipes first" or "newest recipes first" currently has to fetch everything and sort client-side, which defeats the purpose of filtering/paginating on the server and means every client re-implements sorting logic the API should own. It's a small gap, but it's the kind of missing, obviously-expected capability that makes an API feel unfinished to anyone integrating against it.

The GET / handler in src/routes/recipes.js hardcodes orderBy: { id: 'asc' } on its prisma.recipe.findMany call. There is no sortBy or order query parameter -- any such param is silently ignored.

cd nodejs/recipe_api npm run dev # or: docker compose up

curl "http://localhost:3001/recipes?sortBy=cookingTimeMinutes&order=desc"

-> 200 [...] -- still ordered by id ascending; sortBy/order are silently ignored

The tempting shortcut here is orderBy: { [req.query.sortBy]: req.query.order } built directly from user input. Resist it: an unrecognized or malicious sortBy value would either throw an opaque Prisma error (leaking as an unhandled 500) or, depending on how Prisma validates it, silently produce no ordering guarantee at all. A hardcoded allow-list of sortable columns (mirroring how maxCookingTime's value is validated before use) keeps this safe and gives a clean 400 for bad input instead.

Look at how maxCookingTime is validated in the same handler -- that's the shape to follow: validate sortBy against an allow-list and order against ['asc', 'desc'] before building the orderBy object, throwing ValidationError (already imported in this file) on anything that doesn't match.