Order the supplies card by how empty the cartridge is

Rows sorted on iscritical then on printer NAME. Critical is everything
at or below 5%, so a cartridge at 5% and one at 0% tied on the first key
and the alphabet decided which came first.

Wrong order on its own, and worse than it looks: the dashboard queue
keeps only the first few rows per source, so a printer that was
genuinely empty was truncated off the card while a fuller one held its
place. Reported from the floor as "starts at 5% and hides one at 0%",
which is exactly the two bugs compounding.

remaining is already normalised for waste cartridges - a full waste bin
reads as low remaining - so one ascending sort is worst-first for every
supply type, and iscritical falls out of it rather than needing its own
key. Name only breaks ties.

worstremaining is carried on the row because the supplies list is
rendered to text ("Black 0%") before it reaches the client, so the
number the sort needs is gone by then.

The toner forecast report was already worst-first (it sorts on daysleft)
and is unchanged.

Scope: product
(cherry picked from commit 6644a07ae1)

CHANGELOG.md

@@ -128,6 +128,20 @@ ADR-007 and ADR-002.
 
 ### Fixed
 
+- **The printer supplies card was ordered by printer name, so the emptiest
+  cartridge was not first and sometimes was not shown at all.** Rows sorted on
+  "is critical" and then alphabetically, and critical is everything at or below
+  5% - so a cartridge at 5% and one at 0% tied on the first key and the alphabet
+  broke the tie. That is the wrong order on its own, and worse than it looks:
+  the dashboard queue keeps only the first few rows per source, so a printer
+  that was genuinely empty got truncated off the card while a fuller one held
+  its place. The card exists to answer "what do I walk out and change today" and
+  was answering it with the alphabet. Rows now sort by the emptiest cartridge on
+  the printer, ascending. Waste cartridges were already normalised to percent
+  remaining, so one ascending sort is worst-first for every supply type and the
+  critical flag falls out of it rather than needing its own key; the name only
+  breaks ties.
+
 - **A permission became grantable to anonymous visitors because of how it was
   spelled.** `guest_grantable_permissions()` opened any permission whose name
   ended `.view` or `.read` to the guest role, on the reasoning that reading is