Node reordering API: TDD implementation and bug fixes (from PR 21 review)

[joshbrooks]

Goal

Implement/fix the API to reorder FormKit schema node children with optimistic concurrency, following TDD and addressing issues found in PR #21.

Requirements

Feature (from PR 21)

• POST endpoint reorder_node_children accepting parent_id, children (list of child UUIDs in desired order), and optional latest_change for conflict detection.
• Optimistic locking: If client sends latest_change and it does not match server, return 409 Conflict ("change conflict").
• Validation: Only reorder when the set of children exactly matches existing NodeChildren for that parent (same count and IDs).
• Response: Return new order and updated latest_change so client can update cache.
• NodeChildrenManager.latest_change() returns current max track_change for the NodeChildren table.

TDD (tests first)

• Keep/extend tests/test_nodechildren.py as the spec.
• Add tests before implementation changes:
  • 409 when latest_change is stale (no reorder).
  • 400/409 when children don't match (count or IDs); expect clear error, not 500.
  • 200 success with updated latest_change and correct order persisted.
  • 401/403 for unauthenticated/unauthorized if endpoint is protected (then add auth=formkit_auth and permission check).

Implementation fixes

• Handle reorder_children return value: on (None, "Children do not match") return 400 (or 409) with message, not 200.
• Fix docstring typo: "NodeChildern" → "NodeChildren".
• Rename chnge → current_change (or similar).
• Use exc (not E) in except and proper error message.
• Align response type with body: define response schema (e.g. children, latest_change, parent_id) or fix declared type to match returned payload.
• Verify latest_change() yields global max track_change; add unit test that it increases after reorder; use NodeChildren.objects.aggregate(Max("track_change")) if clearer.
• Add auth=formkit_auth and permission check to match create_or_update_node (with test already in place).

Code quality

• Single responsibility: view handles HTTP; reorder_children(payload) does validation and persistence.
• Explicit error paths: 400 bad payload, 409 conflict, 500 unexpected.
• Do not add poetry.lock (project uses uv). Run black, isort, flake8 on changed files.

Order of work

1. Add missing tests (409, validation failure, success, auth).
2. Handle reorder_children return value in view.
3. Align response schema and fix docstrings/typos.
4. Verify/fix latest_change() and add auth.
5. Clean up lockfiles and run formatters/linters.