Dropping a list (stack) does not persist: PUT stacks/{id}/reorder is sent with order: null (400) #8720

Describe the bug

Dropping a list (stack) at a new position on a board does not persist. The list moves on screen, but a reload puts it back where it was.

In the browser network log, the drop sends

PUT /ocs/v2.php/apps/deck/api/v1.0/stacks/16/reorder with body {"order":null,"boardId":5}

and the server answers 400 with an empty body. Just before it, a second request is sent:

PUT /ocs/v2.php/apps/deck/api/v1.0/cards/undefined/reorder with body {"stackId":13,"order":0,"boardId":5}

which is answered 403 (Permission denied).

To Reproduce

1. As the board owner (all permissions), open a board with four lists: Priorities, To Do, In Progress, Completed.
2. Drag the "Completed" list by its header to the left of the other lists and drop it.
3. The list moves on screen. Reload the page: it is back in its original place.

Expected behavior

The new list order is saved.

Additional information

• The server accepts a valid request. PUT .../stacks/16/reorder with {"order":1} returned 200 and the new position was saved. So the problem is the value the web UI sends, not the server or permissions.
• Reading the code (current main): src/components/board/Board.vue calls orderStack({ stack, removedIndex, addedIndex }) from onDropStack, and src/stores/stack.js orderStack() passes addedIndex straight to apiClient.reorderStack(stack.id, addedIndex, stack.boardId) without checking it. In my capture addedIndex arrived as null. I have not worked out why it is null.
• The cards/undefined/reorder request suggests a card drop handler also receives the same drop event (possibly nested drag containers). I have not verified this.
• It still happens when each list has its own distinct order value (0, 1, 2, 3). It first showed up on boards whose lists all had order: 0, but I captured the null request after assigning distinct values, so that is not the cause.
• Caveat on reproduction: the request above was captured from a drag performed with browser automation (synthetic mouse events). A manual drag by a person shows the same visible symptom (the list reverts after reload), but I have not captured the request from a manual drag.

Client details:

• OS: Windows 10
• Browser: Chrome (desktop)
• Version: current stable

PUT /ocs/v2.php/apps/deck/api/v1.0/cards/undefined/reorder
    {"stackId":13,"order":0,"boardId":5}                -> 403 Permission denied
PUT /ocs/v2.php/apps/deck/api/v1.0/stacks/16/reorder
    {"order":null,"boardId":5}                          -> 400 (empty body)