feat(ui): shared confirmation, toasts, error, skeleton, and Back primitives

Stage 1's later screens and modules need the interactions DESIGN.md
fixes once for the product (ADR 0059). @ekklesia/ui gains them,
additively:

- ConfirmationDialog: simple, destructive, or typed-phrase
  confirmation, with severity chosen by the caller. Destructive is
  marked by symbol and frame, not colour alone, and starts on Cancel.
  A required phrase must match exactly (forgiving only surrounding
  whitespace and NFC). While busy, Cancel and Escape are disabled.
- ToastProvider / useToasts: a top-center toast system per React tree,
  never a package singleton (ADR 0040). Live regions are mounted
  before any toast arrives; errors are assertive and persist until
  dismissed; routine toasts last at least three seconds and longer for
  longer text. Timers pause on hover and focus; duplicates refresh;
  errors are never displaced; every timer is cleared on unmount.
- ErrorState: recovery actions, plus collapsed technical details and a
  reference, rendered as bounded inert text.
- Skeleton / SkeletonGroup: an aria-busy region labelled once, with
  every animation stopped under prefers-reduced-motion.
- PageHeader `back` (link or button) above the page's one h1.
- Dialog: the focus trap ADR 0039 deferred, plus focus restoration and
  an accessible description. Escape is now handled on the dialog
  itself, so a drawer it was opened from stays open.

The shell validates Back targets (parseReturnTarget, dashboardBack):
only a canonical Dashboard page on this origin is accepted, otherwise
Back goes to the page's parent. It never uses history.back().

Biome's scope-aware suspicious/noAlert is now an error in the root
biome.json. tests/native-dialogs.test.ts proves it catches real
dialogs and not lookalikes, and scans for the forms the rule misses.
It supersedes the shell-only regex test.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

surfaces/shell/tests/return-target.test.ts

@@ -0,0 +1,102 @@
+// @vitest-environment node
+import { describe, expect, it, vi } from "vitest";
+import { dashboardBack } from "../src/browser/dashboard-back.js";
+import { createMemoryHostHistory } from "../src/browser/host-history.js";
+import { parseReturnTarget } from "../src/return-target.js";
+
+describe("parseReturnTarget", () => {
+  it("accepts a Dashboard page on this origin, as its canonical destination", () => {
+    expect(parseReturnTarget("/")).toEqual({ kind: "overview" });
+    expect(parseReturnTarget("/signage")).toEqual({ kind: "module", moduleId: "signage" });
+    expect(parseReturnTarget("/signage/")).toEqual({ kind: "module", moduleId: "signage" });
+  });
+
+  it("refuses anything that is not a string, or is empty or enormous", () => {
+    for (const value of [undefined, null, 42, {}, ["/signage"], "", `/${"a".repeat(3000)}`]) {
+      expect(parseReturnTarget(value), JSON.stringify(value)).toBeUndefined();
+    }
+  });
+
+  it("refuses every way of naming another origin", () => {
+    for (const value of [
+      "https://evil.example/signage",
+      "http://localhost/signage",
+      "//evil.example/signage",
+      "/\\evil.example",
+      "\\\\evil.example",
+      "javascript:alert(1)",
+      "data:text/html,hi",
+      "  /signage",
+      "/signage\n",
+      "/sign\tage",
+      "signage",
+    ]) {
+      expect(parseReturnTarget(value), value).toBeUndefined();
+    }
+  });
+
+  it("refuses traversal and encoded separators that would normalize into something else", () => {
+    for (const value of [
+      "/signage/../settings",
+      "/./signage",
+      "/signage/%2e%2e/api",
+      "/%2F%2Fevil.example",
+      "/%5Cevil.example",
+      "/signage%2Fx",
+    ]) {
+      expect(parseReturnTarget(value), value).toBeUndefined();
+    }
+  });
+
+  it("refuses a query or fragment, and any path the Dashboard has no page for", () => {
+    for (const value of [
+      "/signage?x=1",
+      "/signage#top",
+      "/api/v1/principal",
+      "/display/signage",
+      "/settings",
+      "/signage/timelines",
+    ]) {
+      expect(parseReturnTarget(value), value).toBeUndefined();
+    }
+  });
+});
+
+describe("dashboardBack", () => {
+  it("goes back to a validated origin when one was supplied", () => {
+    const history = createMemoryHostHistory("/calendar");
+    const back = dashboardBack(history, {
+      fallback: { kind: "overview" },
+      label: (destination) => (destination.kind === "module" ? "Back to Signage" : "Back"),
+      returnTarget: "/signage",
+    });
+
+    expect(back.href).toBe("/signage");
+    expect(back.label).toBe("Back to Signage");
+    back.onBack();
+    expect(history.entries).toEqual(["/calendar", "/signage"]);
+  });
+
+  it("falls back to the page's own parent when the target is missing or unsafe", () => {
+    for (const returnTarget of [undefined, "https://evil.example/", "//evil.example", "/nope/x"]) {
+      const history = createMemoryHostHistory("/calendar");
+      const back = dashboardBack(history, {
+        fallback: { kind: "overview" },
+        returnTarget,
+      });
+      expect(back.href, String(returnTarget)).toBe("/");
+      expect(back.label, String(returnTarget)).toBe("Back");
+      back.onBack();
+      expect(history.entries, String(returnTarget)).toEqual(["/calendar", "/"]);
+    }
+  });
+
+  it("never leaves the Dashboard through the browser's own history", () => {
+    const history = createMemoryHostHistory("/calendar");
+    const go = vi.spyOn(history, "go");
+
+    dashboardBack(history, { fallback: { kind: "overview" } }).onBack();
+
+    expect(go).not.toHaveBeenCalled();
+  });
+});