Add the module navigation contract: manifest v9, module routes, return-to-origin

Stage 1 PR 7 (ADR 0063). A module becomes a first-class part of the Dashboard.

- Manifest v9 = v8 plus optional `navigation`: a Lucide icon from the curated
  MODULE_NAVIGATION_ICONS set, and up to 12 primary pages (stable id, safe
  label, kebab-case path relative to the module root; no traversal, schemes,
  queries, duplicates, or nesting). Validated before activation.
- Version 8 stays accepted beside version 9, each read strictly as itself
  (discriminated union); no released manifest is rewritten. The template
  moves to v9; the released Signage 0.1.5 manifest is a test fixture.
- Real module routes: /<id> is the landing view, /<id>/<page> a declared
  page, anything beneath a page a module-owned detail route; anything else
  is not-found and mounts nothing. api/assets/display are never pages.
- Sidebar: declared icons, pages nested under an open module, one
  aria-current, collapsed and drawer behaviour; v8 modules unchanged.
- module-ui-sdk: ModuleUiHostContext.navigation (location, subscribe,
  navigate, link, settings), refusing anything outside the module's routes;
  undefined on the display host. Mount ABI unchanged.
- Return-to-origin: one `?return=` carrier on Settings URLs, validated by
  parseReturnTarget and against running modules' declared routes; Settings
  Back returns to exactly the originating module page, across refreshes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

surfaces/shell/tests/host-history.test.ts

@@ -65,7 +65,7 @@ describe("the browser host history", () => {
     const view = {
       addEventListener: vi.fn(),
       history: { pushState: vi.fn(), replaceState: vi.fn() },
-      location: { pathname: "/" },
+      location: { pathname: "/", search: "" },
       removeEventListener: vi.fn(),
     };
     const history = createBrowserHostHistory(view);
@@ -87,7 +87,7 @@ describe("the browser host history", () => {
     const view = {
       addEventListener: vi.fn(),
       history: { pushState: vi.fn(), replaceState: vi.fn() },
-      location: { pathname: "/" },
+      location: { pathname: "/", search: "" },
       removeEventListener: vi.fn(),
     };
     const history = createBrowserHostHistory(view);
@@ -100,6 +100,37 @@ describe("the browser host history", () => {
   });
 });
 
+describe("the query, which carries only where to return to (ADR 0063)", () => {
+  it("reads the browser's query, and pushes an address that carries one", () => {
+    const view = {
+      addEventListener: vi.fn(),
+      history: { pushState: vi.fn(), replaceState: vi.fn() },
+      location: { pathname: "/settings/signage", search: "?return=%2Fsignage" },
+      removeEventListener: vi.fn(),
+    };
+    const history = createBrowserHostHistory(view);
+
+    expect(history.search()).toBe("?return=%2Fsignage");
+    // The address already showing, query included, adds no entry; the same path with another query
+    // is another address.
+    history.push("/settings/signage?return=%2Fsignage");
+    expect(view.history.pushState).not.toHaveBeenCalled();
+    history.push("/settings/signage");
+    expect(view.history.pushState).toHaveBeenCalledWith(null, "", "/settings/signage");
+  });
+
+  it("keeps the query beside the path in memory, as the browser does", () => {
+    const history = createMemoryHostHistory("/settings/signage?return=%2Fsignage%2Fmedia");
+
+    expect(history.pathname()).toBe("/settings/signage");
+    expect(history.search()).toBe("?return=%2Fsignage%2Fmedia");
+    history.push("/signage/media");
+    expect(history.search()).toBe("");
+    history.go(-1);
+    expect(history.search()).toBe("?return=%2Fsignage%2Fmedia");
+  });
+});
+
 describe("the in-memory host history", () => {
   it("behaves like the browser's: push truncates forward entries, go steps within bounds", () => {
     const history = createMemoryHostHistory("/");