Add the module navigation contract: manifest v9, module routes, return-to-origin

Stage 1 PR 7 (ADR 0063). A module becomes a first-class part of the Dashboard.

- Manifest v9 = v8 plus optional `navigation`: a Lucide icon from the curated
  MODULE_NAVIGATION_ICONS set, and up to 12 primary pages (stable id, safe
  label, kebab-case path relative to the module root; no traversal, schemes,
  queries, duplicates, or nesting). Validated before activation.
- Version 8 stays accepted beside version 9, each read strictly as itself
  (discriminated union); no released manifest is rewritten. The template
  moves to v9; the released Signage 0.1.5 manifest is a test fixture.
- Real module routes: /<id> is the landing view, /<id>/<page> a declared
  page, anything beneath a page a module-owned detail route; anything else
  is not-found and mounts nothing. api/assets/display are never pages.
- Sidebar: declared icons, pages nested under an open module, one
  aria-current, collapsed and drawer behaviour; v8 modules unchanged.
- module-ui-sdk: ModuleUiHostContext.navigation (location, subscribe,
  navigate, link, settings), refusing anything outside the module's routes;
  undefined on the display host. Mount ABI unchanged.
- Return-to-origin: one `?return=` carrier on Settings URLs, validated by
  parseReturnTarget and against running modules' declared routes; Settings
  Back returns to exactly the originating module page, across refreshes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

core/src/modules/ui-publication.ts

@@ -1,5 +1,7 @@
 import {
   isVersionCompatible,
+  type ModuleNavigationDeclaration,
+  moduleManifestNavigation,
   type PermissionDeclaration,
   type PermissionId,
 } from "@ekklesia/contracts";
@@ -24,10 +26,18 @@ export interface PublishableModuleUi {
    *
    * Carried here so a host can render something a person recognizes instead of a module id. It is
    * presentation *identity*, not presentation *placement*: a module says what it is called, while
-   * where it appears in a Dashboard is configuration an administrator owns. Nothing about grouping,
-   * ordering, or navigation belongs on this record.
+   * where it appears in a Dashboard is configuration an administrator owns. Nothing about grouping
+   * or ordering belongs on this record.
    */
   readonly name: string;
+  /**
+   * What the module declares about its own pages (manifest v9, ADR 0063): the Lucide icon it is
+   * drawn with and its primary pages, in its declared order. Like `name`, this is the module's own
+   * identity — what it is and which pages it has — never where it sits in the Dashboard, which stays
+   * the administrator's (ADR 0027). Empty for a manifest v8 module and for one that declares none:
+   * the generic icon and a single root page.
+   */
+  readonly navigation: ModuleNavigationDeclaration;
   readonly artifactPath: string;
   /**
    * The module's own manifest-declared permissions, carried here so a publisher can compute the
@@ -44,6 +54,18 @@ export interface PublishableModuleUi {
   readonly permissions: readonly PermissionDeclaration[];
 }
 
+/** A fresh, deeply frozen copy, so a caller holding a record never reaches the manifest graph. */
+function frozenNavigation(navigation: ModuleNavigationDeclaration): ModuleNavigationDeclaration {
+  return Object.freeze({
+    ...(navigation.icon === undefined ? {} : { icon: navigation.icon }),
+    pages: Object.freeze(
+      navigation.pages.map((page) =>
+        Object.freeze({ id: page.id, label: page.label, path: page.path }),
+      ),
+    ),
+  });
+}
+
 /**
  * One installed module whose dedicated full-viewport display artifact may be published.
  *
@@ -233,6 +255,7 @@ export function createModuleUiPublicationRegistry(
           artifactPath,
           moduleId: module.manifest.id,
           name: module.manifest.name,
+          navigation: frozenNavigation(moduleManifestNavigation(module.manifest)),
           // Already deeply frozen by discovery; copied into a fresh frozen array so a caller holding
           // this record can never reach the manifest object graph itself.
           permissions: Object.freeze([...module.manifest.permissions]),