Add the module navigation contract: manifest v9, module routes, return-to-origin

Stage 1 PR 7 (ADR 0063). A module becomes a first-class part of the Dashboard.

- Manifest v9 = v8 plus optional `navigation`: a Lucide icon from the curated
  MODULE_NAVIGATION_ICONS set, and up to 12 primary pages (stable id, safe
  label, kebab-case path relative to the module root; no traversal, schemes,
  queries, duplicates, or nesting). Validated before activation.
- Version 8 stays accepted beside version 9, each read strictly as itself
  (discriminated union); no released manifest is rewritten. The template
  moves to v9; the released Signage 0.1.5 manifest is a test fixture.
- Real module routes: /<id> is the landing view, /<id>/<page> a declared
  page, anything beneath a page a module-owned detail route; anything else
  is not-found and mounts nothing. api/assets/display are never pages.
- Sidebar: declared icons, pages nested under an open module, one
  aria-current, collapsed and drawer behaviour; v8 modules unchanged.
- module-ui-sdk: ModuleUiHostContext.navigation (location, subscribe,
  navigate, link, settings), refusing anything outside the module's routes;
  undefined on the display host. Mount ABI unchanged.
- Return-to-origin: one `?return=` carrier on Settings URLs, validated by
  parseReturnTarget and against running modules' declared routes; Settings
  Back returns to exactly the originating module page, across refreshes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

core/tests/dashboard-flat-modules.test.ts

@@ -219,20 +219,25 @@ describe("Dashboard grouping never becomes module structure", () => {
     }
   });
 
-  it("keeps the publication record free of any grouping, ordering, or navigation field", async () => {
+  it("keeps the publication record free of any grouping or ordering field", async () => {
     const registry = createModuleUiPublicationRegistry(await discoverFixtures());
 
     const published = registry.resolve("livestream", "1.0.0");
 
     // The record a host mounts from carries identity, the validated artifact, declared permissions,
-    // and the module's own name — never a group, an order, a parent, or a folder.
+    // the module's own name, and its own declared navigation — never a group, an order, a parent,
+    // or a folder. Navigation is what the module *is* (its icon and pages, ADR 0063); where it sits
+    // stays the administrator's (ADR 0027).
     expect(Object.keys(published ?? {}).sort()).toEqual([
       "artifactPath",
       "moduleId",
       "name",
+      "navigation",
       "permissions",
       "version",
     ]);
+    expect(Object.keys(published?.navigation ?? {}).sort()).toEqual(["pages"]);
+    expect(published?.navigation.pages).toEqual([]);
   });
 
   it("takes the display name from the module's own manifest, not from any folder", async () => {