Cars: drag the Information rows into the order you want

The rows on a car's Information tab now take a drag: they reorder as the
pointer crosses them and the arrangement saves on drop — or on dragend,
since a row released in the gap between rows never produces a drop and
would otherwise revert on the next load. Same native drag events as the
garage, so also pointer-only, and it needs write access.

The order belongs to the car, like the choice of which rows show at all,
so everyone it is shared with sees the same page. It is stored as the
full list of the 14 keys, hidden rows included: a row switched off and
back on returns to where it was rather than to the end. A key the stored
arrangement doesn't mention — a row added in a later release — follows
the arranged ones, the same rule the garage uses for a car added since
the last drag.

fieldOrder rides on the existing PUT /api/cars/{id}/view, which writes
only the lists it is given, so a drag never has to resend what is hidden.
A partial arrangement is accepted; an invented key is still a 400, which
is why normalizeHidden is now normalizeKeys — it validates an order as
well as a switched-off set.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

API Server/internal/api/cars.go

@@ -258,11 +258,11 @@ var hideableCarFields = map[string]bool{
 	"vin": true, "fuelType": true, "buildDate": true, "firstRegistration": true,
 }
 
-// normalizeHidden validates a switched-off set against the keys that exist.
-// Unknown keys are rejected rather than ignored: they can only come from a stale
-// or wrong client, and dropping them silently would hide the mistake while the
-// tab or field stayed visible.
-func normalizeHidden(in []string, allowed map[string]bool, what string) ([]string, error) {
+// normalizeKeys validates a list of tab or field keys against the keys that
+// exist, trimming blanks and duplicates. Unknown keys are rejected rather than
+// ignored: they can only come from a stale or wrong client, and dropping them
+// silently would hide the mistake while the page carried on as before.
+func normalizeKeys(in []string, allowed map[string]bool, what string) ([]string, error) {
 	out := make([]string, 0, len(in))
 	seen := make(map[string]bool, len(in))
 	for _, key := range in {
@@ -271,7 +271,7 @@ func normalizeHidden(in []string, allowed map[string]bool, what string) ([]strin
 			continue
 		}
 		if !allowed[key] {
-			return nil, fmt.Errorf("%q is not a car %s that can be hidden", key, what)
+			return nil, fmt.Errorf("%q is not a car %s", key, what)
 		}
 		seen[key] = true
 		out = append(out, key)
@@ -279,17 +279,19 @@ func normalizeHidden(in []string, allowed map[string]bool, what string) ([]strin
 	return out, nil
 }
 
-// PUT /api/cars/{id}/view — choose what this car's page shows: which tabs, and
-// which rows of the Information tab. Body: {hiddenTabs?: [...], hiddenFields?:
-// [...]}; only the sets present are written, so a client can update one without
-// knowing the other. Its own endpoint rather than fields on the car edit, so an
-// ordinary save of the car form — which sends every other field — can never
-// reveal something somebody deliberately switched off. Needs write access: the
-// choice belongs to the car, so it is the same permission as editing it.
+// PUT /api/cars/{id}/view — choose what this car's page shows: which tabs, which
+// rows of the Information tab, and the order those rows are laid out in. Body:
+// {hiddenTabs?: [...], hiddenFields?: [...], fieldOrder?: [...]}; only the lists
+// present are written, so a client can rearrange the rows without resending what
+// is hidden. Its own endpoint rather than fields on the car edit, so an ordinary
+// save of the car form — which sends every other field — can never reveal
+// something somebody deliberately switched off. Needs write access: the choice
+// belongs to the car, so it is the same permission as editing it.
 func (s *Server) updateCarView(w http.ResponseWriter, r *http.Request) {
 	var in struct {
 		HiddenTabs   *[]string `json:"hiddenTabs"`
 		HiddenFields *[]string `json:"hiddenFields"`
+		FieldOrder   *[]string `json:"fieldOrder"`
 	}
 	if err := decodeJSON(r, &in); err != nil {
 		writeError(w, http.StatusBadRequest, err.Error())
@@ -307,7 +309,7 @@ func (s *Server) updateCarView(w http.ResponseWriter, r *http.Request) {
 
 	payload := map[string]any{}
 	if in.HiddenTabs != nil {
-		tabs, err := normalizeHidden(*in.HiddenTabs, hideableCarTabs, "tab")
+		tabs, err := normalizeKeys(*in.HiddenTabs, hideableCarTabs, "tab")
 		if err != nil {
 			writeError(w, http.StatusBadRequest, err.Error())
 			return
@@ -315,13 +317,25 @@ func (s *Server) updateCarView(w http.ResponseWriter, r *http.Request) {
 		payload["hidden_tabs"] = tabs
 	}
 	if in.HiddenFields != nil {
-		fields, err := normalizeHidden(*in.HiddenFields, hideableCarFields, "field")
+		fields, err := normalizeKeys(*in.HiddenFields, hideableCarFields, "field")
 		if err != nil {
 			writeError(w, http.StatusBadRequest, err.Error())
 			return
 		}
 		payload["hidden_fields"] = fields
 	}
+	if in.FieldOrder != nil {
+		// The same key set as the hidden fields, since every Information row can
+		// be moved. A partial list is accepted rather than demanding all 14: the
+		// rows it leaves out follow the arranged ones, which is also what makes a
+		// row added in a later release land at the end instead of the middle.
+		order, err := normalizeKeys(*in.FieldOrder, hideableCarFields, "field")
+		if err != nil {
+			writeError(w, http.StatusBadRequest, err.Error())
+			return
+		}
+		payload["field_order"] = order
+	}
 	if len(payload) == 0 {
 		writeError(w, http.StatusBadRequest, "no changes provided")
 		return