Cars: drag the tabs into order, and a lock for every arrangement

Two things, both about layouts you arrange by dragging.

A car's tab bar now takes a drag: the tabs reorder as the pointer crosses
them and the arrangement saves on drop — or on dragend, since a tab
released in the gap beside the bar never produces a drop and would
otherwise revert on the next load. Same native drag events as the garage
and the Information rows, so also pointer-only, and it needs write access.

The order belongs to the car, like the choice of which tabs show at all,
so everyone it is shared with sees the same bar. It is stored as the full
list of keys, hidden tabs included, so a tab switched off and back on
returns to where it was rather than to the end; a key the stored
arrangement doesn't mention — a tab added in a later release — follows
the arranged ones. Information is arrangeable although it cannot be
switched off, which is why the validation needs arrangeableCarTabs rather
than reusing hideableCarTabs; it is derived from that set so the two
cannot drift as tabs are added. tabOrder rides on the existing PUT
/api/cars/{id}/view, so a tab drag never has to resend what is hidden.
Where the page opens is unchanged: Information, wherever it now sits.

And a padlock in the sidebar, above the theme toggle, holds every
arrangement in the app still at once — the garage, a car's tabs, its
Information rows, the provider's readings. It is a guard against nudging
a layout while reading it, not a permission: it is the user's own setting
and says nothing about what anybody may edit, so locking hides your own
drag handles rather than stopping a co-owner rearranging a shared car.
Stored as dragLocked on the profile, like the theme it sits above, so a
locked account is still locked on the next device — where a folded
provider card stays one browser's reading habit. Unlocked by default, so
nothing changes until it is clicked, and while locked the grab cursor and
the drag hints go with the drag.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

API Server/scripts/setup-pocketbase.mjs

@@ -279,10 +279,12 @@ const DESIRED = {
     // default. Keys are validated in internal/api/cars.go.
     F.json("hidden_tabs", 2000),
     F.json("hidden_fields", 2000),
-    // The order the Information rows are laid out in, as field keys — the
-    // hidden ones included, so a row switched back on returns to where it was.
-    // Empty means the page's own default order. metric_order is the same for
-    // the headline readings on the connected service's tab.
+    // The order the tabs are laid out in, as tab keys, and the order the
+    // Information rows are laid out in, as field keys — the hidden ones
+    // included in both, so one switched back on returns to where it was. Empty
+    // means the page's own default order. metric_order is the same for the
+    // headline readings on the connected service's tab.
+    F.json("tab_order", 2000),
     F.json("field_order", 2000),
     F.json("metric_order", 2000),
     // Owner of this car. Non-cascading on purpose: deleting a user must not
@@ -464,6 +466,10 @@ const DESIRED = {
       "TRY", "UAH", "USD", "CAD", "AUD", "JPY",
     ]),
     F.select("font_size", ["small", "medium", "large"]),
+    // Holds every arrangement on this user's pages still — the garage, a car's
+    // tabs and Information rows, the provider's readings — so reading a page
+    // cannot nudge its layout. Per user, like car_order.
+    F.bool("drag_locked"),
     F.date("deletion_requested_at"),
     // Access role. Empty value is treated as "user" by the API.
     F.select("role", ["user", "admin", "superadmin"]),