feat(nav): rework the sidebar — nested capability center, dedicated scheduled-tasks and sites entries

[Luhaozhu]

What changed

The sidebar goes from a flat pile of entries to "a few top-level entries + a nested capability center".

Capability center is promoted to a top-level entry, and its four capability kinds — agents / skills / connectors / plugins — become a nested list with a tree guide line. Clicking the parent row collapses or expands it, and that choice is remembered. The in-page tab strip is gone. "MCP tool library" is renamed "connectors" throughout.

Scheduled tasks moves out of the app center into its own top-level entry, with a reworked page: a carousel of recommended tasks (six built-in examples that prefill the create dialog), separate "my scheduled tasks" and "run history" views, sorting, search and an empty state.

Sites is promoted out of the lab. Knowledge base moves from a top-level entry into a tab of my space, right next to file assets — the documents there were already the upstream of "add to a private knowledge base". App center and projects move down into the user avatar menu. Sidebar typography is tightened by one step.

Worth calling out

• Single source of truth for the category list. catalog/abilityTabs.ts feeds both the sidebar's nested items and the page's panes. Pane lookup is a Record<AbilityTabKey, …>, so adding a category without a pane is a compile error rather than a silently blank page.
• Panes mount lazily. Each of the four panes fetches its own list on mount, so entering the capability center used to fire all four request sets at once. They now mount on first visit and stay mounted — opening a single category costs 2 requests instead of 8.
• The user avatar menu renders nested items too, so an administrator who parks the capability center there does not leave its four categories unreachable.
• The startup safety net had a real bug. backfill_navigation_entries only ever checked sidebar_items, so "an operator deliberately moved this entry into the user menu" was indistinguishable from "this deployment is missing the entry" — it got re-seeded into the sidebar on every restart and ended up duplicated across both buckets. Entries now declare a target bucket and count as placed if they appear in either one. Panel copy is also no longer re-typed there; it is read from DEFAULT_PAGE_CONFIG.

Deployment note

The runtime source of truth for sidebar layout is page_config.navigation in the database; the arrays in code are only factory defaults for a fresh install. Existing deployments will not switch to the new layout on their own — the new "scheduled tasks" and "sites" entries get seeded by the startup safety net above, but entries that already exist (such as the capability center) keep their current placement. To move fully to the new layout, adjust it under system config → page config → sidebar layout, which supports moving entries between "sidebar / user menu / disabled" and reordering, and has a "restore defaults" button.

Verification

• tsc -b, the i18n dictionary check and eslint all pass — eslint was diffed line by line against a pristine tree with zero new findings, and two pre-existing errors were removed
• Backend tests/api: 77 passed. test_page_config_backfill.py grew from 6 to 8 cases; the two new ones cover the bug above in both directions (sidebar → menu and menu → sidebar)
• The CE derivation pipeline passes --frontend-check, with the brand gate reporting 0 hits