Let players reorder and hide sidebar panels (progress on #55)

[dmccoystephenson]

Summary

• Two more of Make the dashboard layout configurable and persist it per account #55's acceptance bullets are addressed: sidebar panels can now be shown/hidden
  and reordered by the player. A new Panels block in the Settings panel lists every sidebar
  panel with a show/hide checkbox and ▲/▼ move buttons, plus a Reset Panel Layout button.
• The arrangement is persisted per browser to localStorage under barony_panel_layout
  ({ order: [...], hidden: {...} }) and applied in the same pre-paint pass that already restores
  each panel's open/closed state, so a returning player is not shown the default sidebar first.
• Panels are moved in the DOM rather than restyled with CSS order, so keyboard tab order and
  screen-reader reading order follow what is on screen. The four now-redundant
  .game-sidebar > .section-* { order: N } rules are therefore removed and the markup carries the
  default order instead. As a side effect, a pre-existing ordering bug is fixed: the Run History
  panel had no order rule, so it fell to order: 0 and rendered above Game Status, which
  contradicted PLAYER_GUIDE.md. It now sits under Game Status as documented. The armies panel's
  markup block is moved above policy to preserve the order the deleted CSS rules expressed.
• The Settings panel is deliberately excluded from hiding (its checkbox is disabled, with an
  explanatory tooltip) — hiding the panel that holds these controls would leave no way to bring the
  other panels back. It can still be reordered.
• Focus is returned to the equivalent control after each re-render of the layout rows, so the ▲/▼
  buttons and checkboxes remain usable from the keyboard.
• The order and visibility rules are extracted as pure functions into game-logic.js
  (resolvePanelOrder, movePanelInOrder, isPanelHidden), matching the pattern already used
  there, and are exercised by 12 new cases in the Node suite. resolvePanelOrder also reconciles a
  remembered order against the panels actually present: unknown ids are dropped, duplicates
  collapsed, and a panel added since the player last arranged the sidebar is inserted after the
  panel it follows by default rather than sinking to the bottom.
• PLAYER_GUIDE.md gains an "Arranging the sidebar" section and CHANGELOG.md an Unreleased
  entry. The earlier changelog entry from PR Persist sidebar panel open/closed state across reloads #78, which stated that reordering and showing/hiding
  were still open, is corrected.

Module(s) touched

web-client only. No backend change and no REST-contract change is made.

Scope note on #55

Closes #N is deliberately omitted: #55's remaining bullet — persisting the layout server-side,
keyed to the authenticated account, so it follows a player across devices — is not addressed
here. That work spans both modules and the REST contract and is left for a follow-up cycle; #55 is
kept open for it. #55 was the only open issue at triage, so no other issue was deferred this cycle.

Verification

• mvn test was run locally in both modules: backend 267 tests green, web-client 14 tests
  green (the Thymeleaf /game render tests confirm the reworked template still parses and serves).
• The Node suite (node --test web-client/src/test/js/) could not be run locally — no JS
  runtime is installed in this environment — so the 12 new pure-function cases are verified by the
  CI job on this PR's head rather than locally.
• Coverage gap, stated plainly: the DOM wiring in game.html (checkbox/button handlers, DOM
  reordering, the hidden attribute) and the CSS have no automated coverage — CI compiles and
  renders the page but cannot exercise clicks. A manual smoke test is recommended before merge.

Test plan

• CI green: Backend Build and Test and Web Client Build and Test (the latter includes
  node --test web-client/src/test/js/)
• Manual smoke test: open the game page, use the Settings → Panels controls to hide a panel,
  move a panel up and down, reload, and confirm the arrangement is restored; then use
  Reset Panel Layout and confirm the default order (Game Status, Run History, Armies,
  Change Policy, Settings) returns.

Progress on #55 (kept open for the server-side, per-account persistence bullet).

---

This PR description was drafted during a Gardener session (https://github.com/Stephenson-Software/gardener).

[dmccoystephenson]

Self-review rubric

Scored against the diff and command output on head d16cbb3, not from judgment alone.

• CI (external anchor): PASS — Backend Build and Test and Web Client Build and Test both
  pass on d16cbb3 (run 30869529565). The job log was read rather than the green tick alone:
  Tests run: 17, Failures: 0 for the Maven job (including the new GamePageSidebarLayoutTest,
  3/3) and # tests 29 / # pass 29 / # fail 0 for node --test web-client/src/test/js/, which
  covers all 12 new pure-function cases by name.
• Both-modules: PASS — mvn test was additionally run locally in each module: backend 267
  tests green (untouched by this PR, so the job also serves as the "did the other module break"
  signal), web-client 17 green.
• Scope: PASS with one noted extra — every file is required by the feature. The one addition
  beyond it is documentation correction found during the Phase 7 sweep: MVP.md's sidebar bullet
  omitted the Run History panel, which has shipped since that line was written. It sits in the same
  sentence this PR had to touch anyway, so it was corrected rather than left contradicting the code.
• Tests-new: PASS — the three new exported functions each have cases:
  resolvePanelOrder (7, covering the default fallback, a full remembered arrangement, dropped
  unknown ids, collapsed duplicates, and three insertion positions for a newly added panel),
  movePanelInOrder (3, including non-mutation and both no-op paths), isPanelHidden (1 with 4
  assertions).
• Tests-fix (empirical, not reasoned): PASS — this PR is mostly a feature, but it also corrects
  a real ordering bug (Run History rendered above Game Status, contradicting PLAYER_GUIDE.md,
  because .section-run-history had no order rule and fell to order: 0). The regression test
  was run against the reverted markup: git checkout origin/main -- .../game.html then
  mvn test -Dtest=GamePageSidebarLayoutTest → 2 failures
  (sidebarPanelsAppearInTheDocumentedDefaultOrder: "Expected panel data-panel-id="policy"
  after the panels preceding it ... but it was missing or out of order", and
  settingsPanelHostsTheLayoutControls). Restored, it is 3/3 green. FAIL→PASS confirmed by
  execution.
• Sibling structure: PASS — the new pure functions match game-logic.js's existing shape
  (var-scoped, DOM-free, exported through the same object). GamePageSidebarLayoutTest mirrors
  GamePageRunHistoryTest: same @SpringBootTest + @AutoConfigureMockMvc pair, same private
  renderGamePage() helper, same class-level Javadoc explaining what the markup assertions guard.
• Sibling renames: PASS — nothing is renamed; the new names sit alongside the existing
  resolvePanelOpenState / loadPanelState / savePanelState series as
  resolvePanelOrder / loadPanelLayout / savePanelLayout.
• Constructor-injection: PASS — no new Spring component; the one new test class uses
  @Autowired on a field, which is the convention every sibling test here already follows.
• Override-correct: PASS — no @Override is introduced.
• API-contract: PASS (not applicable) — git diff --name-only origin/main...HEAD lists no file
  under backend/; no endpoint, request, or response shape is touched, so the README API section
  is unaffected.
• Changelog: PASS — an Unreleased Web Client entry is added in the existing ✅ format, and the
  entry from PR Persist sidebar panel open/closed state across reloads #78 stating that reordering and showing/hiding were still open is corrected rather
  than left to contradict this change.
• Docs: PASS — every row of the sources-of-truth table was checked against the implementation:
  PLAYER_GUIDE.md gains an "Arranging the sidebar" section and a Settings-panel bullet;
  README.md gains the barony_panel_layout key alongside barony_settings; MVP.md's sidebar
  bullet is corrected as noted above; CHANGELOG.md as above; DOCS.md needed no change, as it
  indexes files and sections that all still exist.
• Issue resolution: PASS — no Closes #N is claimed. Two of Make the dashboard layout configurable and persist it per account #55's bullets (reorder,
  show/hide) are implemented and the third (server-side per-account persistence) is not, so Make the dashboard layout configurable and persist it per account #55 is
  deliberately left open with that scope named in the PR body.

Findings not covered by a rubric row

• web-client/src/main/resources/templates/game.html:~500 (makeMoveButton call sites, added by
  this PR) — known limitation, deliberate. The ▲/▼ buttons move a panel through the full
  order, hidden panels included. A player who hides a middle panel and then moves its neighbour
  will see one press appear to do nothing, because the panel swapped places with something
  invisible; a second press completes the visible move. Making moves skip hidden panels would need
  its own pure function and cases, which is more than this PR should carry, so it is filed as a
  follow-up rather than fixed here.
• web-client/src/main/resources/templates/game.html:~410 (savePanelLayout, added by this PR) —
  no try/catch, unlike loadPanelLayout. That asymmetry is deliberate: the sibling
  savePanelState directly above behaves the same way, and consistency with it was preferred over
  a guard that would silently revert the player's move. Worth revisiting for both functions
  together if storage-quota failures ever show up.
• No automated coverage for the DOM wiring or the CSS, stated again here because a green CI run
  does not imply it: CI renders the page and runs the pure functions, but cannot click a checkbox,
  press a move button, or observe that a hidden panel actually disappears. The new
  GamePageSidebarLayoutTest narrows the gap by pinning the markup those handlers act on, but a
  manual smoke test is still recommended before merge, per the PR's test plan.

Backlog note

#55 was the only open issue at triage time, so no other issue was deferred this cycle; the untested
draft PR #42 (copilot/*) was left alone as an external contribution.

---

This review comment was drafted during a Gardener session (https://github.com/Stephenson-Software/gardener).