exercise nested mobile navigation through its API boundary

tests/fixtures/api-server.mjs

@@ -148,6 +148,8 @@ const server = createServer(async (request, response) => {
     if (options.hangLogout) return;
     return reply(response);
   }
+  if (path === "/security_group" && request.method === "GET")
+    return reply(response, { list: [], count: 0 });
   if (path === "/ssh_key" && request.method === "GET") {
     if (options.hangSshBody) {
       // 只发送响应头和不完整JSON，保持连接以复现“响应体解码永不结束”。