Cars: drag the tabs into order, and a lock for every arrangement

Two things, both about layouts you arrange by dragging.

A car's tab bar now takes a drag: the tabs reorder as the pointer crosses
them and the arrangement saves on drop — or on dragend, since a tab
released in the gap beside the bar never produces a drop and would
otherwise revert on the next load. Same native drag events as the garage
and the Information rows, so also pointer-only, and it needs write access.

The order belongs to the car, like the choice of which tabs show at all,
so everyone it is shared with sees the same bar. It is stored as the full
list of keys, hidden tabs included, so a tab switched off and back on
returns to where it was rather than to the end; a key the stored
arrangement doesn't mention — a tab added in a later release — follows
the arranged ones. Information is arrangeable although it cannot be
switched off, which is why the validation needs arrangeableCarTabs rather
than reusing hideableCarTabs; it is derived from that set so the two
cannot drift as tabs are added. tabOrder rides on the existing PUT
/api/cars/{id}/view, so a tab drag never has to resend what is hidden.
Where the page opens is unchanged: Information, wherever it now sits.

And a padlock in the sidebar, above the theme toggle, holds every
arrangement in the app still at once — the garage, a car's tabs, its
Information rows, the provider's readings. It is a guard against nudging
a layout while reading it, not a permission: it is the user's own setting
and says nothing about what anybody may edit, so locking hides your own
drag handles rather than stopping a co-owner rearranging a shared car.
Stored as dragLocked on the profile, like the theme it sits above, so a
locked account is still locked on the next device — where a folded
provider card stays one browser's reading habit. Unlocked by default, so
nothing changes until it is clicked, and while locked the grab cursor and
the drag hints go with the drag.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Web App/README.md

@@ -101,6 +101,19 @@ Config (`server/.env`, copy from `.env.example`):
   the same page; setting it needs write access. Stored as the *hidden* sets, so
   anything added in a later release is on by default, and the Information tab
   itself can't be switched off.
+- **Locking the layout** — the padlock in the sidebar, above the theme toggle,
+  holds every arrangement still at once: the garage, a car's tabs, its
+  Information rows, the provider's readings. It is a guard against nudging a
+  layout while reading it, not a permission — it is the user's own setting
+  (`dragLocked` on the profile, so it follows them to the next device) and says
+  nothing about what they may edit. Unlocked by default; while locked the drag
+  cursor and the hints go too.
+- **Arranging the tabs** — the tabs themselves drag into any order, saved on
+  drop. A property of the car like the choice of which tabs show, so everyone it
+  is shared with sees the same bar, and it needs write access. It covers the
+  hidden tabs too, so switching one back on returns it to where it was, and
+  Information is arrangeable even though it can't be switched off. Where the
+  page opens is unchanged: Information, wherever it now sits in the bar.
 - **Arranging the Information rows** — the rows on a car's Information tab drag
   into any order, saved on drop. Also a property of the car, and it covers the
   hidden rows too, so switching one back on returns it to where it was. Same