feat(ui): add a desktop panel rail to each sidebar

Each side stack hosts a Vue rail listing its panels; selecting one opens it
through PanelChrome. The shell owns one Vue runtime and Pinia instance, and a
panel store mirrors each side's panels from the DOM. The rail hides with its
stack, in Cockpit, clean view and recording, and on phones. Panels without a
catalog entry get a generic item, and Data Layers leaves the rail while the
f shortcut hides it.

scripts/check-package-boundaries.mjs

@@ -1,6 +1,7 @@
 import { readFile, realpath } from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
+import vue from '@vitejs/plugin-vue';
 import { build, normalizePath } from 'vite';
 
 /** Build each browser or Node export group and reject imports outside its declared ownership. */
@@ -99,15 +100,20 @@ export async function checkPackageBoundaries(root) {
       ssr: node ? { noExternal: true } : undefined,
       logLevel: 'silent',
       plugins: [
+        vue(),
         {
           name: 'check-package-ownership',
           moduleParsed(info) {
-            if (!allowed.has(info.id)) {
+            // Plugin helpers are virtual; a single-file component's style and
+            // template blocks belong to the component file itself.
+            if (info.id.startsWith('\0')) return;
+            const id = info.id.split('?')[0];
+            if (!allowed.has(id)) {
               throw new Error(
-                `Package boundary ${name} imports an unowned module: ${path.relative(root, info.id)}`,
+                `Package boundary ${name} imports an unowned module: ${path.relative(root, id)}`,
               );
             }
-            seen.add(info.id);
+            seen.add(id);
           },
         },
       ],