docs: track upstream Nimbus starter defects flagged on #43 #46

Summary

The cubic and Greptile reviews on #43 flagged pre-existing defects in Nimbus starter code that the docs site vendors as-is (apps/docs/src/components/ui/**, DocsLayout.astro, starter routes and styles). #43 left them unchanged. Patching them locally would fork files that are kept close to upstream so npx @cloudflare/nimbus-docs diff --apply and add <slug> --overwrite keep working. They are listed here so they can be reported upstream to cloudflare/nimbus, or fixed locally if upstream doesn't pick them up.

Findings

Accessibility

• ui/tabs/TabsContent.astro: manual-mode panels have no aria-controls/aria-labelledby link to their tabs.
• ui/tabs/Tabs.astro: manual composition renders a second <TabsList>, and the indicator binds to the first, empty one.
• ui/steps/Step.astro: component-mode steps lack list semantics.
• ui/search/SearchDialog.astro: the empty/status paragraph sits inside role="listbox" and is not a live region.
• ui/package-managers/package-managers.client.ts: screen readers get no copy-success announcement.
• ui/breadcrumbs/Breadcrumbs.astro: the current crumb has no aria-current="page".

Behavior

• ui/toc/mobile-toc.client.ts: an interrupted jump never calls resolve(). The percentage rootMargin is resolved against the viewport width.
• ui/toc/toc.client.ts: the percentage rootMargin is resolved against the viewport width, not its height.
• ui/toc/TOC.astro: a heading with an empty slug renders href="#".
• ui/breadcrumbs/Breadcrumbs.astro: with maxVisible={2} and three items, the middle crumb appears twice.
• ui/sidebar/sidebar.client.ts: groups opened by the filter are persisted. A nested match leaves its ancestors hidden.
• ui/dialog/dialog.client.ts: unlockScroll() runs twice on close.
• ui/theme-toggle/theme-toggle.client.ts: the toggle does nothing when localStorage throws.
• ui/page-actions/page-actions.client.ts: a failed retry leaves the success checkmark visible.
• ui/code-group/CodeGroup.astro: grouped code is hidden until JavaScript runs (also flagged by Greptile).
• ui/search/search.client.ts: Home/End are always intercepted, so readers can't move the cursor inside the query (Greptile).
• layouts/DocsLayout.astro: draft pages still get data-pagefind-body.

Styles

• styles/globals.css: the copy button is invisible on touch devices.
• ui/steps/Steps.astro: nested ordered lists are styled as steps.
• styles/prose.css: the unlayered heading reset and spacing rules override Tailwind utilities, shrinking Card/Aside titles inside .docs-content (also flagged by Greptile).

Hosting

• pages/nimbus-api/coordinates.json.ts: the Cache-Control header is dropped when the route is prerendered. On Pages it would need public/_headers.

Banner sanitizer (low priority)

• ui/banner/Banner.astro: the regex sanitizer misses unquoted javascript: URLs. Banner content comes only from the site's own build-time config, not from user input, so there is no live exposure. An allowlist sanitizer would still be more robust.

Source

• PR: feat(docs): migrate documentation site from Docus to Nimbus #43
• Reviewers: cubic-dev-ai, greptile-apps