Fix sub-app permissions bug, add Comments app, support Site Editor

- Root-cause fix for "Sorry, you are not allowed to access this page" on
  Menu Creator/Activity Log/Role Editor: remove_submenu_page() was
  corrupting WP core's user_can_access_admin_page() capability lookup.
  Sub-apps now stay registered in $submenu; MenuSerializer filters them
  out of the sidebar instead.
- Add a 6th sub-app, Comments, with a redirect from native edit-comments.php.
- Extend the window-chrome/taskbar framing to the Site Editor
  (site-editor.php), including a fix for a CSS position:fixed
  over-constraint bug that let its frame run past the viewport.
- Rewrite the taskbar from a single sessionStorage slot to a list so
  multiple minimized windows are each independently restorable.
- Extend native-dark.css coverage to the block editor's own chrome.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

app/src/shell/windowChrome.js

@@ -1,30 +1,30 @@
 /**
  * Adds a macOS-style traffic-light title bar to the top of the page content.
- * Most pages render inside #wpbody-content (native WP pages and all of
- * Aurora's own Vue pages, since each mounts its root div there). The
- * Dashboard is the one exception — DashboardTakeover.php renders it into a
- * separate #aurora-admin-dashboard-root sibling, above #wpbody (which it
- * hides), to fully replace the native dashboard, so it gets wrapped in its
- * own frame to match the card treatment #wpbody-content already has. The
- * block editor bypasses both (see SiteShell.vue isBlockEditor), so it's
- * skipped there.
+ * Three cases, in priority order:
+ *  1. The Dashboard — DashboardTakeover.php renders it into a separate
+ *     #aurora-admin-dashboard-root sibling, above #wpbody (which it hides),
+ *     to fully replace the native dashboard. Gets wrapped in a new
+ *     .aurora-dashboard-frame div to match the card treatment
+ *     #wpbody-content already has everywhere else.
+ *  2. The block editor — gets only the traffic-light controls, overlaid on
+ *     the editor frame without a full-width titlebar surface.
+ *  3. Everything else — native WP pages and all of Aurora's own Vue pages,
+ *     since each mounts its root div inside #wpbody-content. The bar is
+ *     inserted as its first child.
  *
  * Red closes (navigates back to the Aurora dashboard). Yellow minimizes —
  * on any page other than the dashboard, that means "save where I am and
  * send me home", with SiteShell.vue's taskbar offering a way back; on the
  * dashboard itself (already home) it just collapses in place instead,
  * since there's nowhere further back to send it. Green hides Aurora's own
- * sidebar/toolbar so the content fills the browser window. All of this is
- * just classes on <html> plus one sessionStorage entry (taskbar.js) — no
- * server-side state.
+ * sidebar/toolbar so the content fills the browser window. Minimized pages
+ * are tracked as a list (taskbar.js), not a single slot, so minimizing
+ * more than one shows up as separate taskbar items rather than the latest
+ * silently replacing the previous one.
  */
-import { setMinimizedWindow, currentPageTitle } from './taskbar.js';
-
-export function initWindowChrome(adminUrl) {
-  if (document.querySelector('.aurora-winbar')) {
-    return;
-  }
+import { addMinimizedWindow, currentPageTitle } from './taskbar.js';
 
+function buildBar(adminUrl, isDashboard) {
   const bar = document.createElement('div');
   bar.className = 'aurora-winbar';
 
@@ -39,8 +39,6 @@ export function initWindowChrome(adminUrl) {
   };
 
   const root = document.documentElement;
-  const dashboardRoot = document.getElementById('aurora-admin-dashboard-root');
-  const isDashboard = !!dashboardRoot;
 
   bar.appendChild(
     makeDot('close', 'Close', () => {
@@ -53,7 +51,7 @@ export function initWindowChrome(adminUrl) {
         root.classList.toggle('aurora-minimized');
         root.classList.remove('aurora-maximized');
       } else {
-        setMinimizedWindow(currentPageTitle(), window.location.href);
+        addMinimizedWindow(currentPageTitle(), window.location.href);
         window.location.href = adminUrl || '/wp-admin/';
       }
     })
@@ -65,7 +63,26 @@ export function initWindowChrome(adminUrl) {
     })
   );
 
+  return bar;
+}
+
+function isBlockEditorPage() {
+  const path = window.location.pathname;
+  return (
+    document.body.classList.contains('block-editor-page') ||
+    path.endsWith('/post-new.php') ||
+    path.endsWith('/post.php')
+  );
+}
+
+export function initWindowChrome(adminUrl) {
+  if (document.querySelector('.aurora-winbar')) {
+    return;
+  }
+
+  const dashboardRoot = document.getElementById('aurora-admin-dashboard-root');
   if (dashboardRoot) {
+    const bar = buildBar(adminUrl, true);
     const frame = document.createElement('div');
     frame.className = 'aurora-dashboard-frame';
     dashboardRoot.parentNode.insertBefore(frame, dashboardRoot);
@@ -74,8 +91,16 @@ export function initWindowChrome(adminUrl) {
     return;
   }
 
+  if (isBlockEditorPage()) {
+    const bar = buildBar(adminUrl, false);
+    bar.classList.add('aurora-winbar--editor');
+    document.body.appendChild(bar);
+    return;
+  }
+
   const wpbodyContent = document.getElementById('wpbody-content');
   if (wpbodyContent) {
+    const bar = buildBar(adminUrl, false);
     wpbodyContent.insertBefore(bar, wpbodyContent.firstChild);
   }
 }