feat: add reorder operation correlation, timing, and diagnostic telemetry

[devin-ai-integration]

Summary

Closes #977 (epic #975). Adds end-to-end correlation for ordering operations so one reorder can be followed from drop to database: silently ignored drops, slow persistence, navigation mid-save, and failures are now all observable.

Stacked on #992 (uses its reorderFixture test helpers) — until #992 merges, this PR's diff also shows the fixture commits. Merge #992 first.

One client-generated operation_id per drag flows through:

SortableTileGrid ──emitReorderDiagnostic({operationId, state, ...})──▶ reorder.operation telemetry events
       │
       └─ reorderCategories(items, operationId) / reorderImages(items, operationId)
              └─ X-Reorder-Operation-Id header
                     └─ category.reorder / image.reorder spans (reorder.operation_id, reorder.entity, reorder.item_count)
                     └─ "reorder.persisted" structured log (entity, item count, duration, outcome, request_id)
                     └─ hriv_reorder_* Prometheus metrics

• frontend/src/reorderDiagnostics.ts (new): newReorderOperationId(), emitReorderDiagnostic(), subscribeReorderDiagnostics(); bounded state vocabulary ignored | queued | coalesced | submitted | committed | conflicted | failed | stale_discarded | abandoned (queued/coalesced/conflicted/stale_discarded are reserved for Implement an atomic, revisioned tile-order API with set-based updates #978–Prevent stale refresh overwrites and add ordering conflict recovery #980; the grid currently emits ignored/submitted/committed/failed/abandoned).
• SortableTileGrid: emits ignored when the in-flight guard discards a genuinely order-changing reorder drop (no-op drops and move-into-category drops are excluded), submitted with scope/indices/counts, committed/failed with duration, and abandoned on unmount during an active save.
• Backend reorder_telemetry.py (new): sanitize_reorder_operation_id (strict ^[A-Za-z0-9-]{8,64}$ so client text never reaches traces/logs), classify_reorder_exception (409 → conflict, other 4xx → client_error, else failure, matching the tracing.py 4xx convention), span annotation, and per-request structured log + metrics.
• Backend reorder_metrics.py (new): hriv_reorder_request_duration_seconds{entity}, hriv_reorder_request_items{entity}, hriv_reorder_requests_total{entity,outcome}, hriv_reorder_client_operations_total{state} — joined into /api/metrics. Labels stay bounded; operation/category IDs are never metric labels (allowlist updated in docs/observability-conventions.md).
• Telemetry ingestion: reorder.operation added to the event allowlist with server-side bounding/coercion of state, item_type, and operation_id.
• Docs: docs/reorder-telemetry.md — full trace-one-operation walkthrough (Loki/Tempo queries) + lifecycle table; linked from README.

Existing tests updated only for the widened contract (added optional operationId argument and the new allowlisted event name).

Needs human verification: confirming the reorder.operation events and hriv_reorder_* metrics appear in the deployed Grafana/Loki/Tempo stack (all names follow the documented conventions).

Testing

• backend: poetry run pytest — 955 passed, 86% coverage (new tests/test_reorder_telemetry.py)
• frontend: npm test — all green (new tests/reorderDiagnostics.test.ts, tests/components/SortableTileGridReorderTelemetry.test.tsx)
• npx tsc --noEmit, npm run format:check clean; the single npm run lint error (CanvasOverlay.tsx react-refresh) is preexisting on main

Link to Devin session: https://app.devin.ai/sessions/414754bd88374dc693f47100ac269e78

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 5 new potential issues.

[devin-ai-integration]

Devin Review found 4 new potential issues.

[devin-ai-integration]

Devin Review found 4 new potential issues.

[devin-ai-integration]

Devin Review found 3 new potential issues.

[devin-ai-integration]

Devin Review found 4 new potential issues.

[devin-ai-integration]

Devin Review found 3 new potential issues.

[devin-ai-integration]

Devin Review found 2 new potential issues.