feat(ui): shared confirmation, toasts, error, skeleton, and Back primitives

Stage 1's later screens and modules need the interactions DESIGN.md
fixes once for the product (ADR 0059). @ekklesia/ui gains them,
additively:

- ConfirmationDialog: simple, destructive, or typed-phrase
  confirmation, with severity chosen by the caller. Destructive is
  marked by symbol and frame, not colour alone, and starts on Cancel.
  A required phrase must match exactly (forgiving only surrounding
  whitespace and NFC). While busy, Cancel and Escape are disabled.
- ToastProvider / useToasts: a top-center toast system per React tree,
  never a package singleton (ADR 0040). Live regions are mounted
  before any toast arrives; errors are assertive and persist until
  dismissed; routine toasts last at least three seconds and longer for
  longer text. Timers pause on hover and focus; duplicates refresh;
  errors are never displaced; every timer is cleared on unmount.
- ErrorState: recovery actions, plus collapsed technical details and a
  reference, rendered as bounded inert text.
- Skeleton / SkeletonGroup: an aria-busy region labelled once, with
  every animation stopped under prefers-reduced-motion.
- PageHeader `back` (link or button) above the page's one h1.
- Dialog: the focus trap ADR 0039 deferred, plus focus restoration and
  an accessible description. Escape is now handled on the dialog
  itself, so a drawer it was opened from stays open.

The shell validates Back targets (parseReturnTarget, dashboardBack):
only a canonical Dashboard page on this origin is accepted, otherwise
Back goes to the page's parent. It never uses history.back().

Biome's scope-aware suspicious/noAlert is now an error in the root
biome.json. tests/native-dialogs.test.ts proves it catches real
dialogs and not lookalikes, and scans for the forms the rule misses.
It supersedes the shell-only regex test.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

surfaces/shell/src/browser/dashboard-back.ts

@@ -0,0 +1,32 @@
+import type { PageHeaderBack } from "@ekklesia/ui";
+import { type DashboardDestination, dashboardPath } from "../dashboard-routes.js";
+import { parseReturnTarget } from "../return-target.js";
+import type { HostHistory } from "./host-history.js";
+
+export interface DashboardBackOptions {
+  /** Where the person came from, if a link said so. Validated; anything unsafe is ignored. */
+  readonly returnTarget?: unknown;
+  /** The page's own parent: where Back goes when there is no valid return target. */
+  readonly fallback: DashboardDestination;
+  /** Names the destination: "Back to Signage". Default "Back". */
+  readonly label?: (destination: DashboardDestination) => string;
+}
+
+/**
+ * A nested Dashboard page's Back action, for `PageHeader` (DESIGN.md §2.7, §4.8; ADR 0059).
+ *
+ * Back returns to the workflow that sent the person here when a validated return target says where
+ * that was; otherwise it goes to the page's declared parent. It never calls the browser's own
+ * `history.back()`: after a bookmark or a link from outside, the previous entry is not the
+ * Dashboard's, and Back must not take the person off the Dashboard. The action is a real link to the
+ * canonical address, so it can also be opened in a new tab.
+ */
+export function dashboardBack(history: HostHistory, options: DashboardBackOptions): PageHeaderBack {
+  const destination = parseReturnTarget(options.returnTarget) ?? options.fallback;
+  const href = dashboardPath(destination);
+  return {
+    href,
+    label: options.label?.(destination) ?? "Back",
+    onBack: () => history.push(href),
+  };
+}

surfaces/shell/src/return-target.ts

@@ -0,0 +1,54 @@
+import { type DashboardDestination, parseDashboardPath } from "./dashboard-routes.js";
+
+/** Long enough for any Dashboard address; short enough that nothing else hides in one. */
+const MAXIMUM_LENGTH = 2048;
+const PLACEHOLDER_ORIGIN = "https://dashboard.invalid";
+
+/**
+ * Reads a "return to where I came from" value into a Dashboard destination, or refuses it
+ * (ADR 0059).
+ *
+ * A return target is input: it arrives from a link another page or module built, so it is treated
+ * as hostile until proven otherwise. ADR 0034 requires any return location to be a separately
+ * validated, same-origin route decision. This is that validation, and it is deliberately narrow:
+ *
+ * - a string of at most 2 KiB, beginning with exactly one `/`;
+ * - no whitespace or control character, no backslash, no percent-encoded slash, backslash, or dot,
+ *   and no dot-segment — nothing a browser would normalize into a different address;
+ * - no query and no fragment, for now;
+ * - and it must be a page the Dashboard actually has (`parseDashboardPath` is not `not-found`).
+ *
+ * The answer is a destination, never the raw string, so the caller can only ever navigate to the
+ * canonical spelling of a real page. How a link carries a return target is the module navigation
+ * contract's decision (ADR 0057); whatever carries it hands the value here first.
+ */
+export function parseReturnTarget(value: unknown): DashboardDestination | undefined {
+  if (typeof value !== "string" || value.length === 0 || value.length > MAXIMUM_LENGTH) {
+    return undefined;
+  }
+  if (!value.startsWith("/") || value.startsWith("//")) {
+    return undefined;
+  }
+  // biome-ignore lint/suspicious/noControlCharactersInRegex: control characters are what is refused.
+  if (/[\s\u0000-\u001f\u007f\\]/u.test(value) || /%(?:2f|5c|2e)/iu.test(value)) {
+    return undefined;
+  }
+  let url: URL;
+  try {
+    url = new URL(value, PLACEHOLDER_ORIGIN);
+  } catch {
+    return undefined;
+  }
+  if (
+    url.origin !== PLACEHOLDER_ORIGIN ||
+    url.search !== "" ||
+    url.hash !== "" ||
+    value.includes("?") ||
+    value.includes("#") ||
+    url.pathname !== value
+  ) {
+    return undefined;
+  }
+  const route = parseDashboardPath(url.pathname);
+  return route.kind === "not-found" ? undefined : route;
+}