snapshot: preserve totp account security baseline

backend/workflows/app_registry.py

@@ -349,6 +349,16 @@ def ensure_portal_app_configs() -> None:
                 'visible_to_staff': visibility.get(ROLE_STAFF, False),
             },
         )
+    normalize_portal_app_sort_orders()
+
+
+def normalize_portal_app_sort_orders() -> None:
+    for section_key, _label in PortalAppConfig.SECTION_CHOICES:
+        configs = list(PortalAppConfig.objects.filter(section=section_key).order_by('sort_order', 'key'))
+        for position, config in enumerate(configs):
+            if config.sort_order != position:
+                config.sort_order = position
+                config.save(update_fields=['sort_order'])
 
 
 def get_portal_app_registry_rows() -> list[dict[str, object]]: