[joshunrau]

What

Three admin-only links sat at the top level of the sidebar: Manage Groups, Manage Users and Manage Permission Sets. They were right beside a group manager's Manage Group link, with the same icon. Every admin page now lives in the Admin Panel:

Admin Panel ▸
  Audit Logs
  Access ▸       Groups · Users · Permission Sets
  Instruments ▸  Form & Interactive · Series · Repositories
  Instance ▸     Settings · Branding · Mail Server

The links drop their "Manage" prefix. "App Settings", "Mail" and "Instrument Repos" become "Settings", "Mail Server" and "Repositories". On a user's page, the note shown when no permission sets exist pointed to "Manage Permission Sets"; it now points to the new location.

• fix(web): a nav group collapsed whenever the path stopped exactly matching one of its links. Following a link inside an admin page, such as Branding → Login Page or Users → Create, therefore closed the Admin Panel. A link now counts as active on paths beneath it. A side effect: Data Hub → Subjects now stays open and highlighted on a subject's pages.
• feat(web): the regrouping.
• test(web): not part of this feature, but CI needs it. 5fa1391 title-cased the walkthrough's "Don't Show Again" button without updating its tests. Main currently fails one of them, which drops WalkthroughProvider.tsx below the 100% coverage gate.

Verification

• Unit: apps/web/src/components/NavGroup/__tests__/NavGroup.test.tsx and apps/web/src/hooks/__tests__/useNavItems.test.ts. I confirmed the new cases fail against the previous code.
• E2E: a new testing/src/specs/admin-navigation.spec.ts, whose specs also fail against the previous code, plus admin-settings.spec.ts updated for the new Spanish labels. AppPage.expandNavGroup now matches labels exactly, because "Access" and "Instruments" are substrings of "Accessible Instruments".
• Results: unit tests, 5,412 of 5,412 passed, at 100% coverage on every metric. The full e2e suite on this branch: 333 passed on the first run. It started with three Chromium launch timeouts, and after that 28 logins hit the API's rate limit (429). The 32 tests that failed and the 2 that didn't run all passed on a --last-failed rerun.
• Not run as specified: the root pnpm lint and pnpm test:e2e stopped at turbo's gateway#db:push, which refused to drop a column that still holds data in my local gateway.db. Instead I ran lint on web and testing directly, and the e2e suite through pnpm --filter @opendatacapture/testing test:e2e. I didn't look at the new sidebar in a browser.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com