Add the module navigation contract: manifest v9, module routes, return-to-origin

Stage 1 PR 7 (ADR 0063). A module becomes a first-class part of the Dashboard.

- Manifest v9 = v8 plus optional `navigation`: a Lucide icon from the curated
  MODULE_NAVIGATION_ICONS set, and up to 12 primary pages (stable id, safe
  label, kebab-case path relative to the module root; no traversal, schemes,
  queries, duplicates, or nesting). Validated before activation.
- Version 8 stays accepted beside version 9, each read strictly as itself
  (discriminated union); no released manifest is rewritten. The template
  moves to v9; the released Signage 0.1.5 manifest is a test fixture.
- Real module routes: /<id> is the landing view, /<id>/<page> a declared
  page, anything beneath a page a module-owned detail route; anything else
  is not-found and mounts nothing. api/assets/display are never pages.
- Sidebar: declared icons, pages nested under an open module, one
  aria-current, collapsed and drawer behaviour; v8 modules unchanged.
- module-ui-sdk: ModuleUiHostContext.navigation (location, subscribe,
  navigate, link, settings), refusing anything outside the module's routes;
  undefined on the display host. Mount ABI unchanged.
- Return-to-origin: one `?return=` carrier on Settings URLs, validated by
  parseReturnTarget and against running modules' declared routes; Settings
  Back returns to exactly the originating module page, across refreshes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/api/tests/dashboard-host-routes.test.ts

@@ -43,7 +43,13 @@ import {
   DashboardHostConfigurationError,
   createDashboardHostRoutes,
 } from "../src/dashboard-host-routes.js";
-import { DASHBOARD_PLATFORM_PAGES, SETTINGS_SECTIONS } from "@ekklesia/shell/dashboard-routes";
+import { MODULE_NAVIGATION_ICONS } from "@ekklesia/contracts";
+import {
+  DASHBOARD_PLATFORM_PAGES,
+  HOST_NAMESPACES,
+  SETTINGS_SECTIONS,
+} from "@ekklesia/shell/dashboard-routes";
+import { DASHBOARD_MODULE_ICON_NAMES } from "@ekklesia/shell/module-icons";
 import {
   MODULE_DISPLAY_DESCRIPTOR_PREFIX,
   MODULE_DISPLAY_PAGE_PREFIX,
@@ -417,6 +423,14 @@ describe("the platform's reserved top-level names (ADR 0057)", () => {
     }
   });
 
+  it("are exactly the Dashboard's platform pages plus the host namespaces it never treats as pages (ADR 0063)", () => {
+    // With module routes nested beneath `/<module-id>/`, the shell must know every other top-level
+    // name: `/api/v1/principal` must never read as the route `v1/principal` of a module called `api`.
+    expect([...DASHBOARD_PLATFORM_PAGES, ...HOST_NAMESPACES].sort()).toEqual([
+      ...RESERVED_TOP_LEVEL_NAMES,
+    ]);
+  });
+
   it("include exactly the Settings sections the shell interprets, so /settings/<module-id> never collides (ADR 0061)", () => {
     expect([...SETTINGS_SECTIONS].sort()).toEqual([...RESERVED_SETTINGS_NAMES]);
     for (const section of SETTINGS_SECTIONS) {
@@ -630,3 +644,10 @@ describe("Dashboard host boundaries", () => {
     }
   });
 });
+
+describe("module navigation icons (ADR 0063)", () => {
+  it("are the same set in the manifest contract and in the Dashboard that draws them", () => {
+    // The platform cannot accept an icon the Dashboard cannot draw, nor draw one it would refuse.
+    expect([...DASHBOARD_MODULE_ICON_NAMES]).toEqual([...MODULE_NAVIGATION_ICONS]);
+  });
+});