feat(locations): drag-to-reorder + three-dot kebab menu on cards

Project location cards now reorderable via drag-and-drop, and the
four inline action buttons (Unassign/Edit/Remove/Delete) collapse into
a single three-dot kebab menu — much cleaner card layout, especially
for projects with many locations.

Data
- MonitoringLocation.sort_order: nullable Integer, default 0.
  Migration `migrate_add_location_sort_order.py` adds the column and
  seeds existing rows with sort_order = alphabetical index per project
  (so the post-migration display order matches what operators see
  today — no surprise reordering).
- get_project_locations + locations-json: ORDER BY sort_order, name.
- Location-create: assigns max(sort_order) + 1 so new locations land
  at the END of the list rather than being interleaved alphabetically.

Reorder endpoint
- POST /api/projects/{p}/locations/reorder
  Body: { location_ids: [uuid, uuid, ...] }
  Validates: all ids belong to this project; raises 404 on missing.
  Applies 0-indexed sort_order matching the provided order.

UI changes (templates/partials/projects/location_list.html)
- Active cards get a draggable="true" attribute + native HTML5
  drag/drop handlers.  Drop reorders the DOM immediately, then posts
  the new order to the reorder endpoint.  Drop-zone visual feedback
  (orange ring on hover, opacity on source during drag).
- Six-dot drag handle icon on the left of each active card; whole
  card body is the drag source but the handle is the visual cue.
- Right side: small Assign pill (only shown when unassigned) +
  three-dot kebab menu containing Unassign/Edit/Remove/Delete.
  Click ⋮ to toggle; click outside or Escape to close.  Only one
  menu open at a time.
- Removed locations are NOT draggable (their order is historical) and
  keep their existing Restore button visible.

The card also shows "{N} events" instead of "Sessions: N" when the
location_type is vibration AND the backend passes event_count in
the payload — which lands in commit 2 of this redesign.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/routers/project_locations.py

@@ -151,7 +151,8 @@ async def get_project_locations(
     if location_type:
         query = query.filter_by(location_type=location_type)
 
-    locations = query.order_by(MonitoringLocation.name).all()
+    # Order by operator-set sort_order, then name as a stable tie-breaker.
+    locations = query.order_by(MonitoringLocation.sort_order, MonitoringLocation.name).all()
 
     # Enrich with assignment info, splitting active vs removed.
     active_data:  list = []
@@ -224,7 +225,7 @@ async def get_project_locations_json(
     if not include_removed:
         query = query.filter(MonitoringLocation.removed_at == None)   # noqa: E711
 
-    locations = query.order_by(MonitoringLocation.name).all()
+    locations = query.order_by(MonitoringLocation.sort_order, MonitoringLocation.name).all()
 
     return [
         {
@@ -256,6 +257,13 @@ async def create_location(
 
     form_data = await request.form()
 
+    # Compute next sort_order so new locations land at the END of the
+    # project's list rather than getting interleaved alphabetically.
+    from sqlalchemy import func
+    max_sort = db.query(func.max(MonitoringLocation.sort_order))\
+        .filter_by(project_id=project_id).scalar()
+    next_sort_order = (max_sort or 0) + 1 if max_sort is not None else 0
+
     location = MonitoringLocation(
         id=str(uuid.uuid4()),
         project_id=project_id,
@@ -265,6 +273,7 @@ async def create_location(
         coordinates=form_data.get("coordinates"),
         address=form_data.get("address"),
         location_metadata=form_data.get("location_metadata"),  # JSON string
+        sort_order=next_sort_order,
     )
 
     db.add(location)
@@ -356,6 +365,57 @@ async def delete_location(
     return {"success": True, "message": "Location deleted successfully"}
 
 
+@router.post("/locations/reorder")
+async def reorder_locations(
+    project_id: str,
+    request: Request,
+    db: Session = Depends(get_db),
+):
+    """
+    Persist a new sort order for a project's monitoring locations.
+
+    Body JSON: { "location_ids": [uuid, uuid, ...] }
+        The list MUST contain location ids in the desired display order.
+        Locations not included in the list keep their current sort_order
+        (useful for the "active locations only — leave removed alone"
+        drag-and-drop UX).
+
+    Updates `sort_order` to the index of each id in the list.  Ties
+    between included and excluded locations fall back to the existing
+    sort_order.
+    """
+    try:
+        payload = await request.json()
+    except Exception:
+        raise HTTPException(status_code=400, detail="Invalid JSON body")
+
+    ids = payload.get("location_ids") or []
+    if not isinstance(ids, list) or len(ids) == 0:
+        raise HTTPException(status_code=400, detail="location_ids must be a non-empty list")
+
+    # Fetch only the locations being reordered and validate ownership.
+    locations = db.query(MonitoringLocation).filter(
+        MonitoringLocation.project_id == project_id,
+        MonitoringLocation.id.in_(ids),
+    ).all()
+
+    found_ids = {l.id for l in locations}
+    missing = [i for i in ids if i not in found_ids]
+    if missing:
+        raise HTTPException(
+            status_code=404,
+            detail=f"Some locations not found in this project: {missing[:3]}…",
+        )
+
+    # Apply 0-indexed sort_order matching the operator's chosen order.
+    by_id = {l.id: l for l in locations}
+    for idx, loc_id in enumerate(ids):
+        by_id[loc_id].sort_order = idx
+
+    db.commit()
+    return {"success": True, "reordered": len(ids)}
+
+
 @router.post("/locations/{location_id}/remove")
 async def remove_location(
     project_id: str,