exercise nested mobile navigation through its API boundary

tests/fixtures/api-server.mjs

@@ -148,6 +148,8 @@ const server = createServer(async (request, response) => {
     if (options.hangLogout) return;
     return reply(response);
   }
+  if (path === "/security_group" && request.method === "GET")
+    return reply(response, { list: [], count: 0 });
   if (path === "/ssh_key" && request.method === "GET") {
     if (options.hangSshBody) {
       // 只发送响应头和不完整JSON，保持连接以复现“响应体解码永不结束”。

tests/review-ui-foundation.e2e.test.mjs

@@ -68,6 +68,10 @@ test(
         "Closing navigation restores the opener",
       );
       await opener.click();
+      // 当前后台菜单把 SSH 放在独立入口；目标安全组位于尚未展开的安全分组。
+      await navigation(page)
+        .getByRole("button", { name: "安全", exact: true })
+        .click();
       await navigation(page)
         .getByRole("link", { name: "安全组", exact: true })
         .click();