exercise nested mobile navigation through its API boundary

tests/review-ui-foundation.e2e.test.mjs

@@ -68,6 +68,10 @@ test(
         "Closing navigation restores the opener",
       );
       await opener.click();
+      // 当前后台菜单把 SSH 放在独立入口；目标安全组位于尚未展开的安全分组。
+      await navigation(page)
+        .getByRole("button", { name: "安全", exact: true })
+        .click();
       await navigation(page)
         .getByRole("link", { name: "安全组", exact: true })
         .click();