Cars: arrange the garage, and choose what a car's page shows

Three things you can now set up rather than live with.

The garage takes a drag: cards reorder as you drag across them and the
arrangement saves on drop — or on dragend, since a card released in the
gap between cards never produces a drop and would otherwise revert on
the next load. It is a per-user list of car ids on the profile, so it
covers cars shared with you and never reorders anybody else's garage;
the API returns /api/cars in that order, so a client only sends the new
one back. Pointer-only: touch browsers don't fire the native drag
events, and this is not worth a dependency.

A car's page is now configurable from the gear in its header: which tabs
it shows, and which of the 14 Information rows. Both belong to the car,
so everyone it is shared with sees the same page — Fuel off on an EV
stays off for all of them — and setting them needs write access. Stored
as the hidden sets, so anything added in a later release is on by
default. PUT /api/cars/{id}/view is its own endpoint precisely so an
ordinary save of the car form, which sends every other field, can never
reveal something that was deliberately switched off. Information itself
can't be hidden: a page with no tabs left would be a dead end.

The connected-service cards fold away, remembered per device, so a
provider that reports eight sections can be trimmed to the two worth
watching. A failed section keeps a short badge in its collapsed header
and puts the provider's own message — a few hundred characters of JSON,
which used to stretch the page sideways — inside the body with
everything else.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

API Server/scripts/setup-pocketbase.mjs

@@ -272,6 +272,13 @@ const DESIRED = {
     // or linked to a connected account; blank for a hand-entered car.
     F.text("provider"),
     F.text("provider_vehicle_id"),
+    // What this car's page shows: the tabs switched off (["fuel"] on an EV) and
+    // the Information rows switched off (["differentialOil"]). Properties of the
+    // car, so everyone it is shared with sees the same page. The hidden sets,
+    // not the visible ones, so anything added in a later release is on by
+    // default. Keys are validated in internal/api/cars.go.
+    F.json("hidden_tabs", 2000),
+    F.json("hidden_fields", 2000),
     // Owner of this car. Non-cascading on purpose: deleting a user must not
     // wipe their cars (account deletion in me.go intentionally leaves cars).
     // required:false at the DB level — the API always sets owner on create and
@@ -444,6 +451,10 @@ const DESIRED = {
     //   { "<plugin>": { "config": {…}, "enabled": bool } }
     // The `enabled` flag is the personal opt-in; see internal/api/integrations.go.
     F.json("pluginSettings"),
+    // The garage order: car ids as this user dragged them, e.g. ["c2","c1"].
+    // Per user rather than per car, so it also covers cars shared with them and
+    // never reorders somebody else's garage. See internal/api/cars.go.
+    F.json("car_order", 20000),
   ],
 };