Add the module navigation contract: manifest v9, module routes, return-to-origin

Stage 1 PR 7 (ADR 0063). A module becomes a first-class part of the Dashboard.

- Manifest v9 = v8 plus optional `navigation`: a Lucide icon from the curated
  MODULE_NAVIGATION_ICONS set, and up to 12 primary pages (stable id, safe
  label, kebab-case path relative to the module root; no traversal, schemes,
  queries, duplicates, or nesting). Validated before activation.
- Version 8 stays accepted beside version 9, each read strictly as itself
  (discriminated union); no released manifest is rewritten. The template
  moves to v9; the released Signage 0.1.5 manifest is a test fixture.
- Real module routes: /<id> is the landing view, /<id>/<page> a declared
  page, anything beneath a page a module-owned detail route; anything else
  is not-found and mounts nothing. api/assets/display are never pages.
- Sidebar: declared icons, pages nested under an open module, one
  aria-current, collapsed and drawer behaviour; v8 modules unchanged.
- module-ui-sdk: ModuleUiHostContext.navigation (location, subscribe,
  navigate, link, settings), refusing anything outside the module's routes;
  undefined on the display host. Mount ABI unchanged.
- Return-to-origin: one `?return=` carrier on Settings URLs, validated by
  parseReturnTarget and against running modules' declared routes; Settings
  Back returns to exactly the originating module page, across refreshes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

surfaces/shell/tests/return-target.test.ts

@@ -7,8 +7,16 @@ import { parseReturnTarget } from "../src/return-target.js";
 describe("parseReturnTarget", () => {
   it("accepts a Dashboard page on this origin, as its canonical destination", () => {
     expect(parseReturnTarget("/")).toEqual({ kind: "overview" });
-    expect(parseReturnTarget("/signage")).toEqual({ kind: "module", moduleId: "signage" });
-    expect(parseReturnTarget("/signage/")).toEqual({ kind: "module", moduleId: "signage" });
+    expect(parseReturnTarget("/signage")).toEqual({
+      kind: "module",
+      moduleId: "signage",
+      path: "",
+    });
+    expect(parseReturnTarget("/signage/")).toEqual({
+      kind: "module",
+      moduleId: "signage",
+      path: "",
+    });
     // Settings pages are Dashboard pages too (ADR 0061).
     expect(parseReturnTarget("/settings")).toEqual({ kind: "settings" });
     expect(parseReturnTarget("/settings/signage")).toEqual({
@@ -59,13 +67,29 @@ describe("parseReturnTarget", () => {
       "/signage?x=1",
       "/signage#top",
       "/api/v1/principal",
+      "/api/auth/sign-out",
+      "/assets/ekklesia-dashboard/app.js",
       "/display/signage",
       "/settings/displays/add",
-      "/signage/timelines",
+      "/signage//",
+      "/signage/a//b",
     ]) {
       expect(parseReturnTarget(value), value).toBeUndefined();
     }
   });
+
+  it("accepts a module's own deeper route, whose page the host then checks (ADR 0063)", () => {
+    expect(parseReturnTarget("/signage/timelines")).toEqual({
+      kind: "module",
+      moduleId: "signage",
+      path: "timelines",
+    });
+    expect(parseReturnTarget("/media/sermons/123")).toEqual({
+      kind: "module",
+      moduleId: "media",
+      path: "sermons/123",
+    });
+  });
 });
 
 describe("dashboardBack", () => {
@@ -84,7 +108,13 @@ describe("dashboardBack", () => {
   });
 
   it("falls back to the page's own parent when the target is missing or unsafe", () => {
-    for (const returnTarget of [undefined, "https://evil.example/", "//evil.example", "/nope/x"]) {
+    for (const returnTarget of [
+      undefined,
+      "https://evil.example/",
+      "//evil.example",
+      "/api/v1/principal",
+      "/signage//",
+    ]) {
       const history = createMemoryHostHistory("/calendar");
       const back = dashboardBack(history, {
         fallback: { kind: "overview" },