Fold the sidebar menu into a single accordion

[frousselet]

Summary

The sidebar listed the whole product tree at once. Every group shipped with collapse show, so roughly 75 rows were on screen before the user did anything : the accordion markup existed but never folded anything on desktop.

Groups now ship folded and share a single data-bs-parent, so exactly one is open at a time, and which one is derived from the URL : the script that highlights the active link opens its group. Nothing is stored per user, because there is nothing a reload could not recompute.

Section headers stay plain labels and flat entries (Roles, Sites, Frameworks, the Compliance and Incidents lists) stay visible : only entries that nest a sub-list fold. The menu goes from ~75 rows to ~36, with every leaf still one click away.

Related issue

None.

Type of change

• Bug fix
• New feature
• Refactor / tech debt
• Documentation
• Build / CI / tooling

Changes

• Every collapsible nav group ships folded (collapse, aria-expanded="false") and carries data-bs-parent=".sidebar-body", making the menu one accordion : opening a group folds the previous one.
• The active-link script opens the group holding the current page, and re-folds the others after a boosted navigation (Bootstrap's accordion only reacts to its own toggles, so a group opened by hand would otherwise stay open alongside the new one).
• That script moves up to sit right after the sidebar markup instead of with the page scripts, so the menu is never painted in the wrong state.
• Fixes the mobile drawer, which forced every group open for users who had collapsed the desktop rail (display: block !important ignored .show). Harmless while everything was expanded anyway, a visible inconsistency now.
• Adds core/tests/test_sidebar_nav.py guarding the markup that makes this true : a group shipping with show would put the whole tree back on screen.

Screenshots

Light, dashboard : groups folded, section headers and flat entries intact.
Dark, /risks/register/ : the Register group is opened by the URL, everything else stays folded.
Accordion : clicking Goods folds Register.
Collapsed icon rail : unchanged (the rail already hid sub-lists).
Mobile drawer : same folded structure, and now honours the fold state with the rail preference set.

Checklist

• Tests added or updated, and pytest passes (3181 passed)
• ruff check passes
• New feature exposed as MCP tools in mcp/tools.py (accurate docstrings and parameter descriptions)
• New feature has REST API endpoints under the app's api/ (serializers, viewsets, routes under /api/v1/)
• UI renders correctly in light and dark mode
• UI renders correctly on mobile (multi-selects, sticky bars, form layouts)
• User-facing strings use _() / {% trans %} with French translations in locale/fr/LC_MESSAGES/django.po (no duplicate msgid; compilemessages passes)
• Lifecycle / workflow respected (state metadata and generic stepper UI; no hardcoded status values)
• README.md updated (features, MCP tools, tech stack, install) when behaviour changed
• CHANGELOG.md updated under ## [Unreleased]
• Brand guidelines respected (docs/brand/brand-guidelines.md); no em dash characters
• Relevant spec under docs/specs/ updated in the same PR
• Project / documentation screenshots captured at 2560x1440 (16:9, 1440p)
• Audit-grade rigor preserved (approval workflows, versioning, history, permission checks not bypassed)

Not ticked, and why

• MCP tools and REST endpoints : this is a client-side rendering default with no server state and no resource to expose. An earlier draft did persist the open groups per user, with a model field, a migration and an endpoint; it was removed once the accordion made the state a pure function of the URL.
• Documentation screenshots : the docs/screenshots/ set is unaffected. The captures above were taken to verify the change, not to be committed.
• README : it documents features, MCP tools, tech stack and installation, none of which change here. It says nothing about the sidebar.
• Spec : there is no navigation spec under docs/specs/ to update. The behaviour is documented where a reader looks for it, in docs/user-guide/finding-your-way.md, which this PR updates.

🤖 Generated with Claude Code