Add the module navigation contract: manifest v9, module routes, return-to-origin

Stage 1 PR 7 (ADR 0063). A module becomes a first-class part of the Dashboard.

- Manifest v9 = v8 plus optional `navigation`: a Lucide icon from the curated
  MODULE_NAVIGATION_ICONS set, and up to 12 primary pages (stable id, safe
  label, kebab-case path relative to the module root; no traversal, schemes,
  queries, duplicates, or nesting). Validated before activation.
- Version 8 stays accepted beside version 9, each read strictly as itself
  (discriminated union); no released manifest is rewritten. The template
  moves to v9; the released Signage 0.1.5 manifest is a test fixture.
- Real module routes: /<id> is the landing view, /<id>/<page> a declared
  page, anything beneath a page a module-owned detail route; anything else
  is not-found and mounts nothing. api/assets/display are never pages.
- Sidebar: declared icons, pages nested under an open module, one
  aria-current, collapsed and drawer behaviour; v8 modules unchanged.
- module-ui-sdk: ModuleUiHostContext.navigation (location, subscribe,
  navigate, link, settings), refusing anything outside the module's routes;
  undefined on the display host. Mount ABI unchanged.
- Return-to-origin: one `?return=` carrier on Settings URLs, validated by
  parseReturnTarget and against running modules' declared routes; Settings
  Back returns to exactly the originating module page, across refreshes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/development/security.md

@@ -416,6 +416,29 @@ holding the channel permission may receive. If it intentionally includes a signe
 URL remains a bearer capability and is forwarded byte-for-byte; fixed transport errors never reflect
 payloads, URLs, permissions, runtime exceptions, paths, or stacks.
 
+### A module's navigation reaches only its own pages, and return links only real Dashboard pages
+
+Module navigation ([ADR 0063](../architecture/decisions/0063-module-navigation-contract-manifest-v9.md))
+is inert data plus a narrow host capability:
+
+- **The manifest supplies no executable or remote presentation.** A module's `navigation` is a
+  Lucide name from a curated set (never an SVG, a URL, or code) and page paths that are lowercase
+  kebab-case segments beneath its own root. Traversal, schemes, queries, and percent-encoding are
+  refused before the module can start.
+- **The module gets no history object, router, or `window`.** It asks to move to a path relative to
+  its own root. The host refuses anything that is not its root, or at or beneath a page it declares,
+  so no module can navigate the Dashboard into another module or a platform page.
+- **The host's own namespaces are never pages.** `/api/…`, `/assets/…`, and `/display/…` are never
+  read as a module route, a page, or a return target.
+- **`?return=` is untrusted input.** It is only ever read through `parseReturnTarget`, which accepts
+  a canonical same-origin Dashboard address and nothing else. A module address must also name a
+  running module and one of its routes. Anything else is ignored, and Back is a real link to that
+  validated address, never `history.back()`.
+
+None of this is a security boundary between modules: module UI is trusted code in the host's page
+(see above). It keeps honest mistakes and hostile links from turning Dashboard navigation into an
+open redirect or an API link.
+
 ### Client-side permission checks are not a security boundary
 
 A host may tell a module UI what permissions it believes the viewer holds