phone-desktop-mode: a Menu with folded sections below 1024 px

The owner, 2026-10-16: "Вариант 1. Но меню выглядит длинной простынёй. Там
бы сделать сворачивание разделов." As the mockup of e0e30e2: the bar's
navbar-menu loses is-active, so Bulma hides it below 1024 px, and the new
touchnav partial (layout.html) takes its place in the brand - Menu, a
<details> whose panel holds Overview, each group as a fold (the current
one open, its page aria-current), and the user's group last with Account,
Help and Sign out (the same POST form as the bar's). The same Show* flags
as the bar decide what is there. panel.css takes the mockup's rules (the
touch navigation, a 1rem gutter for the page and the sibling strip below
1024 px). No script.

The cause, measured, is written in the roadmap row: every width under
1024 px had the always-open menu; "desktop site" (~980 px) added Bulma's
side-by-side columns from 769 px; Bulma's container has no side margin
below 1024 px.

Tests: the Menu marks the current group and page and the bar's menu has
no is-active (TestMenuHighlightsTheCurrentGroupEntryAndSibling), it offers
nothing the bar does not to a domain administrator (TestTouchMenuFollowsTheBar),
the shell's Sign out is counted twice on the password page;
TestPanelCSSIsTheMockupStylesheet. go vet + go test (26 packages) and make
e2e on the test server for this tree. CHANGELOG [Unreleased]; roadmap row
done.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/outbound_test.go

@@ -408,9 +408,10 @@ func TestOutAppCreatedShowsLoginAndPasswordOnce(t *testing.T) {
 	if got := strings.Count(out, `data-copy`); got != 2 {
 		t.Errorf("%d copy buttons, want one for the login and one for the password", got)
 	}
-	// nothing on the page changes anything: Done is a link, so the only form is the shell's Sign out
-	if got := strings.Count(out, `<form`); got != 1 || !strings.Contains(out, `action="/logout"`) {
-		t.Errorf("%d forms on the password page, want the shell's Sign out alone", got)
+	// nothing on the page changes anything: Done is a link, so the only forms
+	// are the shell's Sign out - in the bar and in the Menu of a narrow screen
+	if got := strings.Count(out, `<form`); got != 2 || strings.Count(out, `<form method="post" action="/logout">`) != 2 {
+		t.Errorf("%d forms on the password page, want the shell's two Sign outs alone", got)
 	}
 
 	// An application created just now had no password before.