[timothejoubert]

Summary

v2.8 regression: the custom-form fields list could no longer be reordered by drag-and-drop. The fix wires the rz_table sortable option, as on node attributes, and removes the dead UIkit-based script.

 custom-form-fields/list.html.twig
   rz_table
+    sortable: { enabled: true, url: path('customFormFieldPositionAjax') }
     <tr
-      data-field-id="…"
+      data-id="…"                 # read by RzTable.getSortableItemId
     >
-      <td>label</td>
+      <td class="rz-table__handle">label</td>

 Lazyload.generalBind
-  new CustomFormFieldsPosition()  # listened to `.uk-sortable`, rendered by no template since #279

rz-table already posts id + prevId/nextId + CSRF token, which is the PositionDto payload customFormFieldPositionAjax expects: no PHP change.

Closes #537

Evidence

• Before: fields list of a custom form: no drag handle, dragging does nothing (no data-sortable on the table).
  After (dev app, custom form New Crowdin updates #2 with 3 fields):

drag "un champ" 1st → 2nd   POST …/fields/edit/position 206, success toast   reload: 2:1, 1:2, 3:3  ✓
drag "un champ" 2nd → 1st   POST 206 (nextId path), success toast              reload: 1:1, 2:2, 3:3  ✓
POST with invalid csrfToken  400 { title: "An error occurred" } → RzTable shows it as a danger toast
pnpm lint ✓   pnpm build:check ✓   lint:twig custom-form-fields ✓

Not covered by a real drag: the drop at the last position (same prevId path as the middle drop) and the missing ROLE_ACCESS_CUSTOMFORMS_DELETE case (same error path as the invalid token). Checked in dark theme only.

Merge Danger

Door: two-way

Blast Radius: small

Only the custom-form fields list. window.RozierConfig.routes.customFormFieldPositionAjax is kept in base.html.twig in case a third-party script reads it. Follow-up: UIkit sortable (JS in main.js, CSS in vendor.less) now has no JS consumer left and can be removed.