fix(dashboard): fix buddy dev --dashboard white screen (sidebar ENOENT + Craft HTTPS cert)

[glennmichael123]

./buddy dev --dashboard opened a white / "flash then goes away" Craft window. It was two independent bugs; both needed fixing.

Bug 1 - <Sidebar> ENOENT (content)

The global dashboard layout resolved <Sidebar> from @stacksjs/components, but 0.2.9x stopped shipping tag-resolvable .stx sources (only hashed dist/ output; its own stx-plugin.ts points at an unpublished ./src/ui). So <Sidebar> couldn't resolve, the stx plugin fell back to a filesystem search, and every dashboard page fatal-errored with ENOENT ... open 'sidebar' (#1989).

Fix: render the sidebar from the framework's own buildSidebarChunks() HTML inside a plain <aside data-stx-sidebar>, styled with plain CSS in the layout. No dependency on the external component - the dashboard renders regardless of which @stacksjs/components version is installed. Role gating, section collapse, SPA nav, and active-highlight are wired to the new markup.

Bug 2 - Craft's WKWebView rejects the HTTPS cert (the actual white screen)

The native window opened the HTTPS pretty URL (https://dashboard.stacks.localhost). Craft's WKWebView rejects the tlsx local-CA cert:

DID_FAIL_PROVISIONAL: The certificate for this server is invalid.

Craft installs no didReceiveAuthenticationChallenge handler, so it does not honor the local-CA trust (even though the CA is in the keychain). The provisional navigation fails and the window stays blank / flashes then clears.

Fix: point the native window at http://localhost:<port> (nativeWindowUrl in dev/dashboard.ts). Loopback HTTP needs no cert; the browser-facing "Local" URL stays HTTPS for anyone opening it in a real browser.

How it was verified

A standalone swift + WKWebView + takeSnapshot harness reproduces Craft's exact engine headlessly (headless Chromium does not catch WKWebView TLS/JS issues):

• WKWebView over HTTPS -> certificate is invalid (reproduces the white screen).
• WKWebView over HTTP -> renders the full dashboard, in both normal and the window's transparent titlebarHidden mode.
• / and /commerce/products both render fully (sidebar + content); no Error loading component; lint clean.

Follow-up (Craft repo, optional)

Craft could add a didReceiveAuthenticationChallenge handler to trust the local dev CA, which would let the native window use HTTPS too. Not required for this fix.

Refs #1989