Pair displays at the platform's own /display/setup, with or without modules

Displays are platform-owned, but a screen could only start pairing on a
module's display page: every pairing request named a module, so an
installation with no module that uses displays could not set one up.

- /display/setup is the platform's own display page, served whenever
  the deployment has device support, whatever is installed. It pairs a
  platform display with no module. Once paired, it opens the module it
  is set to show; with none set, it shows its name and waits, rechecking
  so it stays alive and notices revocation. "setup" is now a reserved
  module id.
- Migration core:0009_platform_display_pairing lets a pairing request
  name no module. It relaxes module_id and permission_id and adds a
  both-or-neither check. It is additive and destroys nothing.
- POST /api/v1/device-pairing/requests accepts {} for a platform
  display. Approval accepts an optional moduleId, so the administrator
  can choose an installed display module and the device gets that
  module's declared permission. A module display's own request can't be
  redirected.
- GET /api/v1/device-pairing/self lets a paired device describe itself:
  its name and the module displays it may show. It renews the device's
  cookie.
- GET /api/v1/devices/setup is replaced by
  GET /api/v1/devices/display-modules: the modules a display can be set
  to show.
- Settings -> Displays always offers the /display/setup address, Copy
  setup link and Add display. Add display has an optional "Show on this
  screen" choice, and each paired display says what it shows.
- /display/<module-id> is unchanged, so released Signage 0.1.5 works as
  before.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/api/tests/dashboard-host-routes.test.ts

@@ -20,6 +20,7 @@ import {
   type LegacyModuleRuntimeServices,
   type ModuleDatabase,
   type ModuleLifecycleConfiguration,
+  RESERVED_DISPLAY_HOST_NAMES,
   RESERVED_MODULE_IDS,
   RESERVED_SETTINGS_NAMES,
   RESERVED_TOP_LEVEL_NAMES,
@@ -44,6 +45,7 @@ import {
   createDashboardHostRoutes,
 } from "../src/dashboard-host-routes.js";
 import { MODULE_NAVIGATION_ICONS } from "@ekklesia/contracts";
+import { DISPLAY_SETUP_PATH as SHELL_DISPLAY_SETUP_PATH } from "@ekklesia/shell";
 import {
   DASHBOARD_PLATFORM_PAGES,
   HOST_NAMESPACES,
@@ -51,6 +53,7 @@ import {
 } from "@ekklesia/shell/dashboard-routes";
 import { DASHBOARD_MODULE_ICON_NAMES } from "@ekklesia/shell/module-icons";
 import {
+  DISPLAY_SETUP_PAGE_URL,
   MODULE_DISPLAY_DESCRIPTOR_PREFIX,
   MODULE_DISPLAY_PAGE_PREFIX,
 } from "../src/module-display-path.js";
@@ -437,9 +440,21 @@ describe("the platform's reserved top-level names (ADR 0057)", () => {
       expect(isReservedModuleId(section), section).toBe(true);
     }
     expect(RESERVED_MODULE_IDS).toEqual(
-      [...RESERVED_TOP_LEVEL_NAMES, ...RESERVED_SETTINGS_NAMES].sort(),
+      [
+        ...RESERVED_TOP_LEVEL_NAMES,
+        ...RESERVED_SETTINGS_NAMES,
+        ...RESERVED_DISPLAY_HOST_NAMES,
+      ].sort(),
     );
   });
+
+  it("include the display host's own setup page, so /display/<module-id> never collides (ADR 0065)", () => {
+    expect([...RESERVED_DISPLAY_HOST_NAMES]).toEqual(["setup"]);
+    expect(DISPLAY_SETUP_PAGE_URL).toBe("/display/setup");
+    // The shell opens and links to exactly the address the API serves.
+    expect(SHELL_DISPLAY_SETUP_PATH).toBe(DISPLAY_SETUP_PAGE_URL);
+    expect(isReservedModuleId(DISPLAY_SETUP_PAGE_URL.split("/")[2] ?? "")).toBe(true);
+  });
 });
 
 describe("GET /assets/ekklesia-dashboard/app.js (the Dashboard script)", () => {