docs: sort Prerequisites lists numerically ascending (#100)

Reorder the `## Prerequisites` bullets in 9 modules so prior modules
are listed lowest number first instead of by pedagogical importance or
at random. A trailing "Helpful but not required" group stays last and
is sorted within itself; multi-module bullets sort by their lowest
number. Intro/closing paragraphs are left in place. Prose is unchanged;
only bullet order moves.

Modules touched: 7, 9, 14, 15, 22, 24, 25, 26, 27. The other 18 modules
were already ascending (or have one/zero prereqs) and are untouched.
Module 19's "Helpful but not required: Module 16" correctly trails its
ascending 8/14/18 main list, so it stays as is.

Closes #100

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CamgR4HaVpfaqUViuHUcWw

modules/15-security-scanning/README.md

@@ -9,14 +9,14 @@
 
 ## Prerequisites
 
-- **Module 14: Continuous Integration.** You have a pipeline that runs lint, build, and tests on
-  every push. Security scanning is *more gates on that same pipeline*, so you need somewhere to bolt
-  them on.
+- **Module 1: the `tasks-app`.** The running example. We'll let the AI bolt a "cloud sync" feature
+  onto it and watch it introduce all three failure modes at once.
 - **Module 2: Version Control as a Safety Net.** Scanners flag findings in a diff; you'll commit,
   re-scan, and confirm a gate goes red then green. Secret scanning in particular cares about *history*,
   not just the working tree; that only makes sense once you think in commits.
-- **Module 1: the `tasks-app`.** The running example. We'll let the AI bolt a "cloud sync" feature
-  onto it and watch it introduce all three failure modes at once.
+- **Module 14: Continuous Integration.** You have a pipeline that runs lint, build, and tests on
+  every push. Security scanning is *more gates on that same pipeline*, so you need somewhere to bolt
+  them on.
 
 Helpful but not required: **Module 8 (remotes/hosting)** gives you host-native scanning (Dependabot-style
 alerts, push protection) that lives on the remote; **Module 10 (reviewing code you didn't write)** frames