Add the module navigation contract: manifest v9, module routes, return-to-origin

Stage 1 PR 7 (ADR 0063). A module becomes a first-class part of the Dashboard.

- Manifest v9 = v8 plus optional `navigation`: a Lucide icon from the curated
  MODULE_NAVIGATION_ICONS set, and up to 12 primary pages (stable id, safe
  label, kebab-case path relative to the module root; no traversal, schemes,
  queries, duplicates, or nesting). Validated before activation.
- Version 8 stays accepted beside version 9, each read strictly as itself
  (discriminated union); no released manifest is rewritten. The template
  moves to v9; the released Signage 0.1.5 manifest is a test fixture.
- Real module routes: /<id> is the landing view, /<id>/<page> a declared
  page, anything beneath a page a module-owned detail route; anything else
  is not-found and mounts nothing. api/assets/display are never pages.
- Sidebar: declared icons, pages nested under an open module, one
  aria-current, collapsed and drawer behaviour; v8 modules unchanged.
- module-ui-sdk: ModuleUiHostContext.navigation (location, subscribe,
  navigate, link, settings), refusing anything outside the module's routes;
  undefined on the display host. Mount ABI unchanged.
- Return-to-origin: one `?return=` carrier on Settings URLs, validated by
  parseReturnTarget and against running modules' declared routes; Settings
  Back returns to exactly the originating module page, across refreshes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/tests/fixtures/released-v8-signage-0.1.5.module.json

@@ -0,0 +1,161 @@
+{
+  "manifestVersion": 8,
+  "id": "signage",
+  "name": "Signage",
+  "description": "Visual programming, timelines, synchronized channels, and display delivery for church screens.",
+  "version": "0.1.5",
+  "compatibility": {
+    "platform": "^0.2.0",
+    "moduleSdk": "^0.2.0"
+  },
+  "database": {
+    "abi": 1
+  },
+  "capabilities": [
+    {
+      "id": "signage.content-providers",
+      "version": "1.0.0"
+    },
+    {
+      "id": "signage.slide-renderer",
+      "version": "1.0.0"
+    },
+    {
+      "id": "signage.playback",
+      "version": "1.0.0"
+    },
+    {
+      "id": "signage.displays",
+      "version": "1.0.0"
+    }
+  ],
+  "permissions": [
+    {
+      "id": "signage.view",
+      "baseline": "restricted",
+      "description": "View Signage timelines, images, channels, provider health, and display health."
+    },
+    {
+      "id": "signage.assets.manage",
+      "baseline": "restricted",
+      "description": "Upload, rename, expire, and delete Signage's own native images."
+    },
+    {
+      "id": "signage.timelines.manage",
+      "baseline": "restricted",
+      "description": "Create, edit, reorder, duplicate, schedule, and delete saved timelines."
+    },
+    {
+      "id": "signage.playback.control",
+      "baseline": "restricted",
+      "description": "Activate timelines and operate live playback transport for a channel group."
+    },
+    {
+      "id": "signage.displays.manage",
+      "baseline": "restricted",
+      "description": "Create channel groups and audience channels, and assign or rename viewers."
+    },
+    {
+      "id": "signage.display.view",
+      "baseline": "restricted",
+      "description": "Render the Signage full-viewport display and report its own health."
+    }
+  ],
+  "configuration": [
+    {
+      "key": "timezone",
+      "type": "string",
+      "default": "America/Chicago",
+      "minLength": 1,
+      "maxLength": 64,
+      "description": "IANA time zone this installation's Signage schedules are written and displayed in."
+    },
+    {
+      "key": "nativeImageDurationSeconds",
+      "type": "integer",
+      "default": 7,
+      "minimum": 1,
+      "maximum": 3600,
+      "description": "How long a native Signage image is shown when no slot override applies."
+    },
+    {
+      "key": "crossfadeMilliseconds",
+      "type": "integer",
+      "default": 1000,
+      "minimum": 0,
+      "maximum": 10000,
+      "description": "How long a display fades an incoming slide over the outgoing one."
+    },
+    {
+      "key": "defaultBackgroundMode",
+      "type": "enum",
+      "values": ["blurred", "solid", "black"],
+      "default": "blurred",
+      "description": "How a native image that is not 16:9 is backed when a slot says nothing."
+    },
+    {
+      "key": "defaultBackgroundColor",
+      "type": "string",
+      "default": "#000000",
+      "minLength": 7,
+      "maxLength": 7,
+      "description": "The solid background colour used when the background mode is solid."
+    },
+    {
+      "key": "defaultBackgroundDarkened",
+      "type": "boolean",
+      "default": false,
+      "description": "Whether a native image's background is darkened behind the foreground by default."
+    },
+    {
+      "key": "defaultBlurPixels",
+      "type": "integer",
+      "default": 20,
+      "minimum": 0,
+      "maximum": 120,
+      "description": "Blur radius applied to a blurred native-image background."
+    },
+    {
+      "key": "providerTimeoutMilliseconds",
+      "type": "integer",
+      "default": 2000,
+      "minimum": 100,
+      "maximum": 15000,
+      "description": "How long Signage waits for one content-provider call before treating it as failed."
+    },
+    {
+      "key": "playbackHistoryLimit",
+      "type": "integer",
+      "default": 50,
+      "minimum": 2,
+      "maximum": 500,
+      "description": "How many resolved selections per channel group are retained as playback history."
+    },
+    {
+      "key": "viewerHeartbeatWriteSeconds",
+      "type": "integer",
+      "default": 30,
+      "minimum": 5,
+      "maximum": 600,
+      "description": "Shortest interval between two persisted heartbeat writes for one steady viewer."
+    }
+  ],
+  "storage": {
+    "buckets": [
+      {
+        "id": "native-images",
+        "description": "Archived original uploads and generated renditions for Signage's native images."
+      }
+    ]
+  },
+  "entrypoints": {
+    "server": "./dist/server/index.js",
+    "schema": "./dist/schema/index.js",
+    "migrations": "./drizzle",
+    "ui": "./dist/ui/index.js",
+    "display": {
+      "artifact": "./dist/display/index.js",
+      "permission": "signage.display.view"
+    }
+  }
+}