fix(web/starlight): render top-level link-only sidebar entries as leaf links (#2182)

* test(cli): add dockerized sshd fixture for deploy SSH tests

Two openssh-server containers (ports 22022/22023) plus lifecycle
helpers. Deterministic test keypair committed to the repo for
reproducibility; no production value.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(web/starlight): render top-level link-only sidebar entries as leaf links

The sidebar loader unconditionally wrapped every top-level entry as
`{ label, collapsed, items }`, so any entry without an `items` array (or
with an empty one) rendered as a collapsible group header with no children
and discarded its `link`. Glossary hit this on the v4-0-0-snapshot sidebar:
`{"label": "Glossary", "link": "/v4-0-0-snapshot/glossary/"}` rendered as
an unclickable stub in the nav, even though the page built and was
reachable by URL.

Fix: when a top-level entry has a `link` and no children, pass it through
as `{ label, link }` so Starlight renders it as a leaf. Groups with
children continue to be wrapped as before.

Verified against a clean develop build: Glossary now renders
`<a href="/v4-0-0-snapshot/glossary/">` in the sidebar HTML.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: bpamiri

cli/lucli/tests/_fixtures/deploy/sshd/README.md

@@ -0,0 +1,15 @@
+# SSH test fixture
+
+Two openssh-server containers on host ports 22022 and 22023, user `deploy`
+with sudo and password auth disabled. Used by SshClientSpec (Task 6+) and
+SshPoolSpec (Task 9).
+
+## Start / Stop
+
+```bash
+bash tools/deploy-sshd-up.sh
+bash tools/deploy-sshd-down.sh
+```
+
+`test_key` is a deterministic ed25519 keypair committed to the repo — it
+has NO production value and exists only for test reproducibility.

cli/lucli/tests/_fixtures/deploy/sshd/authorized_keys

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIED8dz5J/2zX6dKwp5Oqlp5wguhfg4lY0Pg91Z/tIa/h wheels-deploy-test

cli/lucli/tests/_fixtures/deploy/sshd/docker-compose.yml

@@ -0,0 +1,24 @@
+services:
+  sshd1:
+    image: linuxserver/openssh-server:latest
+    environment:
+      PUBLIC_KEY_FILE: /keys/authorized_keys
+      USER_NAME: deploy
+      SUDO_ACCESS: "true"
+      PASSWORD_ACCESS: "false"
+    volumes:
+      - ./authorized_keys:/keys/authorized_keys:ro
+    ports:
+      - "22022:2222"
+
+  sshd2:
+    image: linuxserver/openssh-server:latest
+    environment:
+      PUBLIC_KEY_FILE: /keys/authorized_keys
+      USER_NAME: deploy
+      SUDO_ACCESS: "true"
+      PASSWORD_ACCESS: "false"
+    volumes:
+      - ./authorized_keys:/keys/authorized_keys:ro
+    ports:
+      - "22023:2222"

cli/lucli/tests/_fixtures/deploy/sshd/test_key

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACBA/Hc+Sf9s1+nSsKeTqpaecILoX4OJWND4PdWf7SGv4QAAAJim5WLOpuVi
+zgAAAAtzc2gtZWQyNTUxOQAAACBA/Hc+Sf9s1+nSsKeTqpaecILoX4OJWND4PdWf7SGv4Q
+AAAEA7Lvr2A4p8d/fupWxM/MobsLDDSUaaOpzvnX83Wb5ukED8dz5J/2zX6dKwp5Oqlp5w
+guhfg4lY0Pg91Z/tIa/hAAAAEndoZWVscy1kZXBsb3ktdGVzdAECAw==
+-----END OPENSSH PRIVATE KEY-----

cli/lucli/tests/_fixtures/deploy/sshd/test_key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIED8dz5J/2zX6dKwp5Oqlp5wguhfg4lY0Pg91Z/tIa/h wheels-deploy-test

tools/deploy-sshd-down.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+FIX_DIR="$(cd "$(dirname "$0")/.." && pwd)/cli/lucli/tests/_fixtures/deploy/sshd"
+docker compose -f "$FIX_DIR/docker-compose.yml" down

tools/deploy-sshd-up.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+FIX_DIR="$(cd "$(dirname "$0")/.." && pwd)/cli/lucli/tests/_fixtures/deploy/sshd"
+docker compose -f "$FIX_DIR/docker-compose.yml" up -d
+sleep 5

web/sites/guides/astro.config.mjs

@@ -45,11 +45,19 @@ function buildSidebarForVersion(version) {
 	return {
 		label: version.label,
 		collapsed: version.collapsed,
-		items: groups.map((g) => ({
-			label: g.label,
-			collapsed: version.collapsed,
-			items: (g.items || []).map(normalizeItem).filter(Boolean),
-		})),
+		items: groups.map((g) => {
+			// Top-level entry with a link and no children → render as a leaf link,
+			// not a collapsible group. Without this, Starlight would wrap it as an
+			// empty group and drop the link entirely (Glossary hit this bug).
+			if (g.link && (!g.items || g.items.length === 0)) {
+				return { label: g.label, link: g.link };
+			}
+			return {
+				label: g.label,
+				collapsed: version.collapsed,
+				items: (g.items || []).map(normalizeItem).filter(Boolean),
+			};
+		}),
 	};
 }