Add the module navigation contract: manifest v9, module routes, return-to-origin

Stage 1 PR 7 (ADR 0063). A module becomes a first-class part of the Dashboard.

- Manifest v9 = v8 plus optional `navigation`: a Lucide icon from the curated
  MODULE_NAVIGATION_ICONS set, and up to 12 primary pages (stable id, safe
  label, kebab-case path relative to the module root; no traversal, schemes,
  queries, duplicates, or nesting). Validated before activation.
- Version 8 stays accepted beside version 9, each read strictly as itself
  (discriminated union); no released manifest is rewritten. The template
  moves to v9; the released Signage 0.1.5 manifest is a test fixture.
- Real module routes: /<id> is the landing view, /<id>/<page> a declared
  page, anything beneath a page a module-owned detail route; anything else
  is not-found and mounts nothing. api/assets/display are never pages.
- Sidebar: declared icons, pages nested under an open module, one
  aria-current, collapsed and drawer behaviour; v8 modules unchanged.
- module-ui-sdk: ModuleUiHostContext.navigation (location, subscribe,
  navigate, link, settings), refusing anything outside the module's routes;
  undefined on the display host. Mount ABI unchanged.
- Return-to-origin: one `?return=` carrier on Settings URLs, validated by
  parseReturnTarget and against running modules' declared routes; Settings
  Back returns to exactly the originating module page, across refreshes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/development/api.md

@@ -1165,6 +1165,13 @@ How this installation presents its mountable modules
             "api": { "baseUrl": "/api/v1/modules/livestream" },
             "realtime": { "baseUrl": "/api/v1/module-realtime/livestream" },
             "permissions": ["livestream.streams.read"]
+          },
+          "navigation": {
+            "icon": "video",
+            "pages": [
+              { "id": "streams", "label": "Streams", "path": "streams" },
+              { "id": "archive", "label": "Archive", "path": "archive" }
+            ]
           }
         }
       ]
@@ -1174,6 +1181,13 @@ How this installation presents its mountable modules
 }
 ```
 
+`navigation` is what the module itself declares in manifest version 9
+([ADR 0063](../architecture/decisions/0063-module-navigation-contract-manifest-v9.md)): the Lucide
+icon the Dashboard draws it with, and its primary pages in declared order. It is
+`{ "icon": null, "pages": [] }` for a module that declares none, which every manifest version 8
+module is: the generic icon and a single root page. It sits beside the host-neutral descriptor,
+never inside it, and says nothing about where the module is placed.
+
 ### Navigation versus inventory
 
 They are deliberately separate, and this route is layered **on top of** the inventory rather than