Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@internal/handler/group_handler.go`:
- Around line 137-166: Change GroupReorderItemRequest.Sort from int to *int so
you can distinguish omitted vs explicit 0 (update the struct
GroupReorderItemRequest). In validateGroupReorderItems, add a nil check for
item.Sort and return the "validation.reorder_sort_negative" (or a new
"validation.reorder_sort_required") error when item.Sort == nil, and keep the
negative-value check against *item.Sort. Finally, update the code that maps
request items into the internal model/DB (the block that reads Items and assigns
Sort) to dereference the pointer (*item.Sort) when constructing the target
objects.
- Around line 27-30: The type assertion for services.I18nError currently returns
false when svcErr is a typed-nil, which incorrectly signals the error wasn't
handled; change the logic in the block that checks "if svcErr, ok :=
err.(*services.I18nError); ok {" so that if svcErr == nil you treat it as an
internal error (handle/log/respond as other I18nError cases) and return true
instead of false; ensure the branch for nil svcErr follows the same
error-response/handling pathway as the non-nil svcErr cases so callers see the
error was handled.

In `@internal/services/group_service.go`:
- Around line 315-325: The COUNT-based existence check is racy; after counting
you must ensure each Update actually modified a row or lock the target rows
beforehand. Fix by either selecting and locking the groups before the loop
(e.g., use tx.Clauses(clause.Locking{Strength:"UPDATE"}).Where("id IN ?",
ids).Find(&groups)) then perform updates, or after each
tx.Model(&models.Group{}).Where("id = ?", item.ID).Update("sort", item.Sort)
check the result.RowsAffected and if RowsAffected != 1 return
NewI18nError(app_errors.ErrValidation, "validation.reorder_group_not_found",
nil); ensure you use the tx result variable (e.g., res :=
tx.Model(...).Update(...)) to inspect res.Error and res.RowsAffected and return
parsed DB errors when res.Error != nil.

In `@web/src/components/keys/GroupList.vue`:
- Around line 233-239: On failed reorder (inside the catch block around
reorderGroups) don't just roll back displayGroups to previousOrder; also
re-fetch the authoritative list from the server to avoid leaving a stale local
state. Update the catch path that references reorderGroups, displayGroups,
previousOrder, savingOrder and suspendAutoScroll to call the same refresh/fetch
routine you use in Keys.vue (the view-level fetch or refreshGroups function) or
emit the existing refresh event so the component reloads groups from the server,
then keep the existing error toast.

---

Outside diff comments:
In `@web/src/components/keys/GroupList.vue`:
- Around line 384-417: The drag handle (div.group-icon) is not
keyboard-accessible; make it a real focusable control and add keyboard reorder
support by replacing the non-focusable <div class="group-icon"> with a <button>
(or add tabindex="0") and wire keydown handlers that call the existing
drag/reorder logic (use handleDragStart(group.id)/handleDragEnd or delegate to
new methods like handleReorderUp(group.id) and handleReorderDown(group.id));
ensure the aria-describedby still references `drag-hint-${group.id}`
(dragDisabledHint) and update the handlers referenced in the template
(group-icon, handleDragStart, handleDragEnd, dragDisabledHint) so keyboard users
can focus the control and use ArrowUp/ArrowDown (or Space/Enter to pick up + Esc
to cancel) to reorder items.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@web/src/components/keys/GroupList.vue`:
- Around line 379-383: The ref access inside the template ref callback is using
groupItemRefs.set(...) on a Ref<Map<...>> which causes a runtime error; update
the callback to call groupItemRefs.value.set(group.id, el as HTMLElement) (and
ensure null checks for el and group.id remain) so you operate on the underlying
Map; reference the existing symbol groupItemRefs and the callback that checks
group.id to locate and fix the code.