feat: add display kiosk host

CONTRIBUTING.md

@@ -36,18 +36,24 @@ pnpm infrastructure:config
 - Modules own their own UI and author it in React and TypeScript (ADR 0022). A module package may
   contain `.tsx` and depend on `react`, `react-dom`, and `@ekklesia/module-ui-sdk`. Every other UI
   framework, `.jsx`, stylesheets, and other presentation formats remain rejected by
-  `pnpm boundaries`. UI source lives at `src/ui/index.tsx` and `pnpm build` compiles it to the
-  artifact the manifest declares, via `@ekklesia/module-ui-build` (ADR 0023) — module authors write
-  no bundler configuration. Styling is React inline style objects only for now, and no host mounts a
-  UI entrypoint yet.
+  `pnpm boundaries`. Primary and display sources live at the exact `src/ui/index.tsx` and
+  `src/display/index.tsx` conventions; one `pnpm build` invocation atomically compiles every role
+  the v6 manifest declares via `@ekklesia/module-ui-build` (ADR 0023/0033). Module authors write no
+  bundler configuration, and styling is React inline style objects only for now. Both roles use the
+  same UI SDK context with no presentation-mode flag.
 - Module UI reaches its host only through `@ekklesia/module-ui-sdk` — never
   `@ekklesia/module-ui-host`, which is the host-side loader — and asks the host for its own
   API by relative path — never by constructing `/api/v1/modules/<id>/...`, which is Ekklesia's
   private deployment detail and would break standalone hosting.
 - The containing application shell, navigation, global theme, and platform policy belong to Core and
   the host application, never to a module. Ekklesia's own shell is `surfaces/shell`; it discovers
-  installed module UIs through `GET /api/v1/module-ui` and mounts them with
-  `@ekklesia/module-ui-host`, and it statically imports no module (ADR 0026).
+  primary module UIs through `GET /api/v1/dashboard/navigation`, resolves a dedicated display
+  through `GET /api/v1/module-displays/<module-id>`, mounts both with
+  `@ekklesia/module-ui-host`, and statically imports no module (ADR 0026/0033).
+- Dedicated displays are module-owned renderers mounted by a separate full-viewport surface at
+  `/display/<module-id>`, never Dashboard UI with hidden chrome. Its page and descriptor require the
+  module-owned, non-public permission declared by `entrypoints.display`; artifact bytes remain
+  anonymous trusted code. Public/device identity, display inventory, and variants are deferred.
 - Dashboard groups are presentation configuration, never module structure. Do not add a parent
   module, child module, owning module, or group-derived dependency: real module relationships are
   the dependency contract's job alone, and grouping must never influence discovery, dependency