Add the module navigation contract: manifest v9, module routes, return-to-origin

Stage 1 PR 7 (ADR 0063). A module becomes a first-class part of the Dashboard.

- Manifest v9 = v8 plus optional `navigation`: a Lucide icon from the curated
  MODULE_NAVIGATION_ICONS set, and up to 12 primary pages (stable id, safe
  label, kebab-case path relative to the module root; no traversal, schemes,
  queries, duplicates, or nesting). Validated before activation.
- Version 8 stays accepted beside version 9, each read strictly as itself
  (discriminated union); no released manifest is rewritten. The template
  moves to v9; the released Signage 0.1.5 manifest is a test fixture.
- Real module routes: /<id> is the landing view, /<id>/<page> a declared
  page, anything beneath a page a module-owned detail route; anything else
  is not-found and mounts nothing. api/assets/display are never pages.
- Sidebar: declared icons, pages nested under an open module, one
  aria-current, collapsed and drawer behaviour; v8 modules unchanged.
- module-ui-sdk: ModuleUiHostContext.navigation (location, subscribe,
  navigate, link, settings), refusing anything outside the module's routes;
  undefined on the display host. Mount ABI unchanged.
- Return-to-origin: one `?return=` carrier on Settings URLs, validated by
  parseReturnTarget and against running modules' declared routes; Settings
  Back returns to exactly the originating module page, across refreshes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/tests/module-manifest.test.ts

@@ -7,6 +7,7 @@ import {
   MODULE_DEPENDENCY_KINDS,
   MODULE_MANIFEST_VERSION,
   MODULE_RUNTIME_STATES,
+  SUPPORTED_MODULE_MANIFEST_VERSIONS,
   MODULE_STORAGE_BLOCKED_REASON,
   packageRelativePathSchema,
   parseModuleManifest,
@@ -256,15 +257,17 @@ describe("module manifest contract", () => {
     expect(safeParseModuleManifest(version6Manifest).success).toBe(false);
   });
 
-  it("accepts exactly one manifest version, so no document can be read as two versions", () => {
-    expect(MODULE_MANIFEST_VERSION).toBe(8);
-    for (const manifestVersion of [1, 2, 3, 4, 5, 6, 7, 9, "8", 8.5, null]) {
+  it("accepts exactly versions 8 and 9, each as itself, so no document is read as two versions", () => {
+    expect(MODULE_MANIFEST_VERSION).toBe(9);
+    expect(SUPPORTED_MODULE_MANIFEST_VERSIONS).toEqual([8, 9]);
+    for (const manifestVersion of [1, 2, 3, 4, 5, 6, 7, 10, "8", "9", 8.5, null]) {
       expect(safeParseModuleManifest({ ...validManifest(), manifestVersion }).success).toBe(false);
     }
-    expect(
-      safeParseModuleManifest({ ...validManifest(), manifestVersion: MODULE_MANIFEST_VERSION })
-        .success,
-    ).toBe(true);
+    for (const manifestVersion of SUPPORTED_MODULE_MANIFEST_VERSIONS) {
+      const parsed = safeParseModuleManifest({ ...validManifest(), manifestVersion });
+      expect(parsed.success).toBe(true);
+      expect(parsed.success && parsed.data.manifestVersion).toBe(manifestVersion);
+    }
   });
 
   it("defaults contributions to an empty list for a module that contributes nothing", () => {