Order Edge App settings as declared in the manifest

docs/EdgeApps.md

@@ -483,6 +483,7 @@ Edge App settings support additional input field types beyond plain text and pas
   - `properties.type`: One of `datetime`, `number`, `select`, `boolean`, `textarea`, `url`.
   - `properties.help_text`: Human-friendly description shown in the UI.
   - `properties.options` (only for `select`): Array of `{ label, value }` options.
+  - `properties.display_order`: Optional integer controlling the order settings render in the install/edit UI (ascending). If omitted, `screenly edge-app deploy` auto-assigns one from the setting's position in the manifest's `settings:` mapping, so settings render in declaration order by default. Set an explicit value only to override that default. An explicitly authored `display_order` is never overwritten by the automatic assignment. Note that `deploy` only sends the computed order to the backend; it never rewrites your manifest file.
   - `properties.depends_on`: Optional `{ setting, values }` object that makes this field's visibility depend on another setting's current value. The field only renders (and is submitted) while `setting`'s current value is one of `values`, otherwise it's hidden and skipped. A malformed or stale reference (a typo in `setting`, or a setting later renamed or removed) fails open, so the field stays visible rather than disappearing. A field with `depends_on` can still be marked `optional: false`; its required-ness is only enforced while the field is visible, and is skipped along with the rest of validation while it's hidden.
 - **Storage**: Use `type: string` for all non-secret fields; use `type: secret` for password-like fields. The UI will coerce values appropriately (e.g., booleans) but values are stored as strings unless `type: secret`.
 - **Defaults**: Provide `default_value` at the setting level. For booleans, use `'true'` or `'false'` as strings.
@@ -589,6 +590,32 @@ settings:
         type: url
 ```
 
+**Explicit display order override**
+
+```yaml
+settings:
+  number_field:
+    type: string
+    title: Attendee Count
+    optional: false
+    help_text:
+      schema_version: 1
+      properties:
+        help_text: The expected count of attendees
+        type: number
+        display_order: 2
+  date_time_field:
+    type: string
+    title: Start Date Time
+    optional: false
+    help_text:
+      schema_version: 1
+      properties:
+        help_text: The start date and time of the event
+        type: datetime
+        display_order: 1
+```
+
 **Conditional visibility**
 
 ```yaml
@@ -629,6 +656,11 @@ In this example, `refresh_interval_seconds` only appears in the install and edit
 Notes:
 
 - These descriptors are backward-compatible; if no JSON is provided, the UI falls back to a plain text field for `string` and a password field for `secret`.
+- Some settings are excluded from the automatic `display_order` assignment and are left to the UI's default ordering:
+  - Settings of `type: secret` that do not already provide a descriptor, so that the UI's password-field fallback keeps applying. To order a secret, give it an explicit descriptor with a `display_order`.
+  - Internal `screenly_*` settings generated by the CLI for `auth:` and remote entrypoints. They are not declared in the manifest, so they have no authored position.
+  - A small set of setting names whose help text is managed outside of the CLI: `azure_ad_resource`, `azure_ad_scope`, `bypass_cors`, `cache_interval`, `limit`, `message_body`, `override_coordinates`, `override_locale`, `override_timezone`, `rss_url`, `stop_id`, `target_timestamp`, and `theme`. Since these are otherwise easy to pick by accident, `deploy` prints a warning naming any of these it skipped.
+- A setting whose `help_text` looks like a schema (it has `schema_version`) but whose `properties` value isn't itself an object is left completely untouched: no `type`, `options`, `advanced`, or `display_order` is applied, and the UI shows the raw JSON as the field's help text. `deploy` prints a separate warning naming these settings — fix the `properties` value to resolve it.
 
 #### Integrations