Fix the Stage 1 Dashboard UX defects found in assembled review

The assembled Stage 1 Dashboard was reviewed by hand on a desktop, with
the sidebar collapsed, and on an iPhone. This fixes what that review
found, and records the decisions in ADR 0064:

- Discover is its own page at /settings/discover, with Installed and
  Updates beneath it as children. There is no Browse item any more.
  /settings/discover/browse is still read, as an alias, and is respelled
  in place. Parents and children now read as a hierarchy: a guide line,
  text-only children, a disclosure chevron, and parent and current
  states that look different.
- The sidebar is navigation only. Display pairing moves from the sidebar
  and drawer to Settings -> Displays: the paired displays, a deliberate
  Add display dialog, and revocation. Nothing takes focus on arrival;
  the code field is focused only once Add display is chosen.
- Collapsed icons are centred. Nav-link layout moves from inline styles
  to the shell stylesheet, and every collapsed item is one square
  centred on the rail.
- /settings is an overview of the installation: displays paired,
  modules installed and running, and a line for each other area. It
  reads only existing endpoints.
- Phones get a sticky, safe-area-aware header holding the menu trigger
  and the page name. New pages start at the top, and focus no longer
  scrolls content under the header.
- @ekklesia/ui draws checkbox and radio indicators from tokens rather
  than accent-color, so the selected state is the strong accent in
  Light and Dark alike.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

surfaces/shell/tests/dashboard-routes.test.ts

@@ -12,6 +12,7 @@ import {
   returnTargetFromSearch,
   dashboardPath,
   parseDashboardPath,
+  DISCOVER_CHILD_VIEWS,
   DISCOVER_VIEWS,
   SETTINGS_SECTIONS,
 } from "../src/dashboard-routes.js";
@@ -134,26 +135,41 @@ describe("Settings routes (ADR 0061)", () => {
     }
   });
 
-  it("reads Discover's three views, entering Discover at Browse, its one canonical address", () => {
-    for (const view of DISCOVER_VIEWS) {
+  it("reads Discover's own page at /settings/discover, and Installed and Updates beneath it", () => {
+    expect(DISCOVER_CHILD_VIEWS).toEqual(["installed", "updates"]);
+    // Discover itself is where modules are found and installed (ADR 0064): one canonical address.
+    expect(parseDashboardPath("/settings/discover")).toEqual({ kind: "discover", view: "browse" });
+    expect(parseDashboardPath("/settings/discover/")).toEqual({ kind: "discover", view: "browse" });
+    expect(dashboardPath({ kind: "discover", view: "browse" })).toBe("/settings/discover");
+    for (const view of DISCOVER_CHILD_VIEWS) {
       expect(parseDashboardPath(`/settings/discover/${view}`), view).toEqual({
         kind: "discover",
         view,
       });
+      expect(dashboardPath({ kind: "discover", view }), view).toBe(`/settings/discover/${view}`);
     }
-    // `/settings/discover` means Browse, and the shell respells it `/settings/discover/browse` in
-    // place, so there is one meaningful Browse address rather than two.
-    expect(parseDashboardPath("/settings/discover")).toEqual({ kind: "discover", view: "browse" });
-    expect(dashboardPath({ kind: "discover", view: "browse" })).toBe("/settings/discover/browse");
     for (const pathname of [
       "/settings/discover/catalog",
       "/settings/discover/browse/signage",
+      "/settings/discover/installed/signage",
       "/settings/discover//",
     ]) {
       expect(parseDashboardPath(pathname), pathname).toEqual({ kind: "not-found" });
     }
   });
 
+  it("still reads the earlier /settings/discover/browse, only as an alias the shell respells", () => {
+    // A bookmark from before ADR 0064 keeps working: it reads as Discover's own page, whose one
+    // canonical spelling is `/settings/discover`, so the shell replaces it in place.
+    expect(parseDashboardPath("/settings/discover/browse")).toEqual({
+      kind: "discover",
+      view: "browse",
+    });
+    expect(dashboardPath(parseDashboardPath("/settings/discover/browse") as never)).toBe(
+      "/settings/discover",
+    );
+  });
+
   it("reads every other name as a module's settings — never under /settings/modules/", () => {
     expect(parseDashboardPath("/settings/signage")).toEqual({
       kind: "module-settings",