feat(shell): give every Dashboard page a real URL

The Dashboard had one address. The API served the page only at `/`, both
reference proxies forwarded only `/`, and the open module lived in React
state, so a refresh went back to the first module, nothing could be
bookmarked, and Back left the Dashboard (DESIGN.md §2.7).

ADR 0057 makes the address bar the source of truth:

- `/` is a host-owned Overview, now the landing page; `/modules/<id>`
  mounts that module. An id the server's navigation does not list shows
  "This page isn't available" and loads nothing; any other Dashboard
  address is a host-owned "Page not found".
- `/modules`, `/settings`, and `/account` are reserved whole, from one
  list (`@ekklesia/shell/dashboard-routes`) that the shell's router and
  the API's page routes both read. The API serves the same frozen page,
  ETag, and security headers anywhere inside them; look-alikes and other
  methods stay the sanitized 404.
- A small host-owned history replaces the selected-module state, built in
  the entry point so it stays the only file touching `window`. Navigation
  items are real links; modified clicks are left to the browser. Focus
  moves to the page after an in-place change, and the tab is named after
  the page.
- Sign-in still happens in place with no return value (ADR 0034), so a
  deep link opens its own page after sign-in.
- Both reference Caddyfiles forward the new paths; the deploy smoke now
  reloads a module's address through the real proxy and requires it to
  mount again.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

deploy/Caddyfile.split.example

@@ -45,11 +45,13 @@
 	header_up -True-Client-IP
 }
 
-# The Dashboard: its page and its one script, nothing else. Emailed verification and reset links land
-# on `/` with a query. `/api/*` is refused here on purpose, so the session cookie has exactly one
-# home, the API hostname, and the Dashboard can never fall back to a same-origin API.
+# The Dashboard: its page — at `/` and at every Dashboard page (/modules, /settings, and /account,
+# each with everything below it), so a refreshed deep link stays put — and its one script, nothing
+# else. Emailed verification and reset links land on `/` with a query. `/api/*` is refused here on
+# purpose, so the session cookie has exactly one home, the API hostname, and the Dashboard can never
+# fall back to a same-origin API.
 {$EKKLESIA_DASHBOARD_HOSTNAME} {
-	@dashboard path / /assets/ekklesia-dashboard/*
+	@dashboard path / /assets/ekklesia-dashboard/* /modules /modules/* /settings /settings/* /account /account/*
 
 	handle @dashboard {
 		reverse_proxy api:3000 {