fix(sidebar): make sidebar interop work inside Razor Class Libraries + CLI install hardening

[Shewart]

Summary

SidebarProvider now uses the host-loaded shellui.js for its JavaScript calls instead of dynamically importing ./shellui-sidebar.js. The relative import resolved against the page URL, so it returned a 404 whenever the generated component was compiled into a consumer's own Razor Class Library, where the asset is served from _content/<Library>/. The error was swallowed by a try/catch, so mobile detection and the Ctrl/Cmd+B shortcut silently did nothing. This came up in a real consumer (FDMS.UI).

This PR also hardens init / add / update in the CLI and refreshes the docs.

Changes

Templates

• shellui-js: adds ShellUI.initSidebar(handle, dotNetRef) / ShellUI.disposeSidebar(handle) (media-query mobile detection plus the Ctrl/Cmd+B shortcut, tracked per handle). The file now extends window.ShellUI with Object.assign instead of replacing it.
• sidebar-provider: calls the global helpers with a per-instance handle, depends on shellui-js instead of sidebar-js, and logs interop failures instead of swallowing them.
• sidebar: no longer depends on sidebar-js.
• sidebar-js: kept as a hidden legacy entry, only for projects that still have the old generated provider.
• copy-button: removed the import("./_content/ShellUI.Components/shellui.js") attempt and calls ShellUI.copyToClipboard directly.

CLI

• add with dependencies: if a dependency fails, the parent is now marked failed instead of being installed on top of a missing dependency. NuGet packages are still collected for components whose files were skipped as already present.
• Upgrading shellui.js: if the existing wwwroot/shellui.js predates the sidebar API, add rewrites it. If the file is marked customized, add stops and tells the user to update it by hand.
• update:
  • Before rewriting a component that depends on shellui-js, it makes sure a compatible shellui.js is installed.
  • It now records the new version in shellui.json. Previously it passed skipConfig: true, so versions were never updated.
• remove sidebar-js: refuses while the project's SidebarProvider still imports the legacy module.
• init:
  • Fails loudly if shell or shellui-js can't be installed.
  • Both are now recorded in shellui.json.
  • shellui.json is written only after the Tailwind build succeeds, so a failed init can be re-run.
• npm Tailwind path: runs npx @tailwindcss/cli (the Tailwind v4 package name) instead of npx tailwindcss.
• Messages: all user-facing hints say shellui … instead of dotnet shellui …, because it's installed as a global tool.

Tests (98 passing)

• RelativeJsModuleImportTests: fails if any template dynamically imports a relative ./ or ../ JS module (sidebar-js is exempt as the legacy entry).
• SidebarInteropTests: checks that the provider uses the global helpers, that shellui.js exposes and cleans up the sidebar API, that sidebar-js is hidden and nothing depends on it, and that the NuGet package's SidebarProvider keeps its _content/ path.
• sidebar-provider added to RazorTemplate_CodeBlockParses.

CI

• The init smoke test checks that SidebarProvider.razor calls ShellUI.initSidebar and does not import shellui-sidebar.js, that shellui.js exposes initSidebar / disposeSidebar, and that a fresh sidebar install does not write wwwroot/shellui-sidebar.js.

Docs

• README files (root, CLI, Components, Templates) and docs/* rewritten against the current registry: 73 direct CLI targets, 173 registry entries, and a CLI command list that matches the tool.
• RELEASE_NOTES.md: adds an "Unreleased / current source" section above the historical v0.3.0-rc.1 notes.
• The safelist regeneration hint in SafelistDriftTests now includes the .targets output path.

Backward compatibility

• Existing projects that already have wwwroot/shellui-sidebar.js and the old provider keep working, because sidebar-js stays in the registry.
• Running shellui update sidebar-provider moves a project to the new interop and upgrades shellui.js if needed.
• The ShellUI.Components NuGet package is unchanged. Its SidebarProvider still imports its own asset through _content/ShellUI.Components/.

Test plan

• dotnet build ShellUI.slnx -c Release
• dotnet test ShellUI.slnx -c Release (98/98)
• CI init smoke job (new sidebar assertions)
• Manual check: shellui add dashboard-02 in a Razor Class Library consumed by a Blazor Server host. The sidebar should collapse at widths under 768px and toggle with Ctrl+B.

Follow-ups (separate PR, before v0.3.0-rc.2)

• 22 templates expose ClassName while the NuGet package components expose Class. Class="…" falls through to the unmatched attributes and can drop the base styling (the Skeleton report).
• shellui add exits with code 0 even when components fail.
• release.yml uses the whole of RELEASE_NOTES.md as the release body; it needs to use only the section for the tag being released.
• update prints "Updated" and counts skipped components as successfully updated.