feat(admin): sortable form-help blocks with two-panel UI

- Migration 005: add sort_order column to form_help_blocks
- Database: getAllFormHelpBlocks orders by sort_order; new reorderFormHelpBlocks()
- actions/form-help-reorder.php: HTMX POST handler, CSRF-validated, 204 response
- templates/admin/contenus.php: replace flat table with two-panel layout
  - Left: SortableJS 1.15.2 + htmx drag-and-drop ordered block cards
  - Right: static form structure reference showing fieldsets and their inputs
- admin.css: .fhb-* styles for layout, cards, ghost/chosen/drag states, anchors
- schema.sql: updated form_help_blocks DDL with sort_order column

app/public/admin/actions/form-help-reorder.php

@@ -0,0 +1,47 @@
+<?php
+/**
+ * HTMX handler: persist the new drag-and-drop sort order for form help blocks.
+ *
+ * Expects POST fields:
+ *   csrf_token   — standard admin CSRF token
+ *   block[]      — ordered list of block keys (one hidden input per block, submitted by
+ *                  Sortable+htmx via the form's `end` event trigger)
+ *
+ * Returns a 204 No Content on success (htmx will not swap anything).
+ * On error, returns a 400 with a plain-text message.
+ */
+require_once __DIR__ . '/../../../bootstrap.php';
+require_once __DIR__ . '/../../../src/AdminAuth.php';
+AdminAuth::requireLogin();
+
+if (!isset($_POST['csrf_token'], $_SESSION['csrf_token'])
+    || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
+    http_response_code(403);
+    echo 'Token invalide.';
+    exit;
+}
+
+$keys = $_POST['block'] ?? [];
+if (!is_array($keys) || empty($keys)) {
+    http_response_code(400);
+    echo 'Paramètre block[] manquant.';
+    exit;
+}
+
+// Sanitise: keep only scalar strings, deduplicate.
+$keys = array_values(array_unique(array_filter($keys, 'is_string')));
+
+require_once APP_ROOT . '/src/Database.php';
+$db = new Database();
+
+try {
+    $db->reorderFormHelpBlocks($keys);
+} catch (Exception $e) {
+    error_log('form-help-reorder error: ' . $e->getMessage());
+    http_response_code(500);
+    echo 'Erreur lors de la sauvegarde.';
+    exit;
+}
+
+http_response_code(204);
+exit;