feat: universal sidebar via sidebar.js + stale ID cleanup

- Add js/sidebar.js: generates full sidebar HTML into #app-sidebar,
  handles role-based visibility, active link (with prefix matching),
  toggle wiring, collapsed state, board/features/notif init
- Replace <aside class="sidebar">...</aside> with <aside id="app-sidebar">
  across all 35 standard-layout pages via scripts/apply-sidebar.js
- Add notifications.js to 5 pages that were missing it
- Fix api.js initPage(): skip toggle re-wiring if data-sb-wired set,
  fix active link selector .sb-item → .sb-link
- Remove stale sbl-*/nav-admin/btn-upload-nav getElementById calls
  that crashed after sidebar replacement (lab, classes, collection,
  crossword, hangman, knowledge-map, library, pet, profile)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/red-book.html

@@ -767,6 +767,7 @@
 <script src="https://cdn.jsdelivr.net/npm/lucide@0.469.0/dist/umd/lucide.min.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/three@0.149.0/build/three.min.js"></script>
 <script src="/js/api.js"></script>
+  <script src="/js/sidebar.js"></script>
 <script src="/js/mobile.js"></script>
 <script>
 /* ══════════════════════════════════════════════════════════════════════════
@@ -789,8 +790,10 @@ const XP_MAP = { CR: 50, EN: 40, VU: 30, NT: 20, LC: 10 };
    Init
    ══════════════════════════════════════════════════════════════════════════ */
 async function init() {
-  LS.hideDisabledFeatures?.();
   lucide.createIcons();
+  const feats = await LS.loadFeatures().catch(() => ({}));
+  if (feats.red_book === false) { window.location.replace('/403'); return; }
+  LS.hideDisabledFeatures?.();
 
   // Auth (sidebar)
   const user = LS.getUser?.() || null;