feat(shell): give every Dashboard page a real URL

The Dashboard had one address. The API served the page only at `/`, both
reference proxies forwarded only `/`, and the open module lived in React
state, so a refresh went back to the first module, nothing could be
bookmarked, and Back left the Dashboard (DESIGN.md §2.7).

ADR 0057 makes the address bar the source of truth:

- `/` is a host-owned Overview, now the landing page; `/modules/<id>`
  mounts that module. An id the server's navigation does not list shows
  "This page isn't available" and loads nothing; any other Dashboard
  address is a host-owned "Page not found".
- `/modules`, `/settings`, and `/account` are reserved whole, from one
  list (`@ekklesia/shell/dashboard-routes`) that the shell's router and
  the API's page routes both read. The API serves the same frozen page,
  ETag, and security headers anywhere inside them; look-alikes and other
  methods stay the sanitized 404.
- A small host-owned history replaces the selected-module state, built in
  the entry point so it stays the only file touching `window`. Navigation
  items are real links; modified clicks are left to the browser. Focus
  moves to the page after an in-place change, and the tab is named after
  the page.
- Sign-in still happens in place with no return value (ADR 0034), so a
  deep link opens its own page after sign-in.
- Both reference Caddyfiles forward the new paths; the deploy smoke now
  reloads a module's address through the real proxy and requires it to
  mount again.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

surfaces/shell/tests/host-history.test.ts

@@ -0,0 +1,119 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { createBrowserHostHistory, createMemoryHostHistory } from "../src/browser/host-history.js";
+
+describe("the browser host history", () => {
+  beforeEach(() => {
+    window.history.replaceState(null, "", "/");
+  });
+
+  afterEach(() => {
+    window.history.replaceState(null, "", "/");
+  });
+
+  it("reads the address bar's path and moves it with real history entries", () => {
+    const history = createBrowserHostHistory(window);
+    const lengthBefore = window.history.length;
+
+    history.push("/modules/example");
+
+    expect(history.pathname()).toBe("/modules/example");
+    expect(window.location.pathname).toBe("/modules/example");
+    expect(window.history.length).toBe(lengthBefore + 1);
+  });
+
+  it("adds no entry when the page asked for is already open", () => {
+    const history = createBrowserHostHistory(window);
+    history.push("/modules/example");
+    const length = window.history.length;
+    const listener = vi.fn();
+    history.subscribe(listener);
+
+    history.push("/modules/example");
+
+    expect(window.history.length).toBe(length);
+    expect(listener).not.toHaveBeenCalled();
+  });
+
+  it("corrects the current entry in place with replace", () => {
+    const history = createBrowserHostHistory(window);
+    history.push("/modules/example/");
+    const length = window.history.length;
+
+    history.replace("/modules/example");
+
+    expect(window.location.pathname).toBe("/modules/example");
+    expect(window.history.length).toBe(length);
+  });
+
+  it("notifies after its own changes and after the browser's Back and Forward", () => {
+    const history = createBrowserHostHistory(window);
+    const listener = vi.fn();
+    const unsubscribe = history.subscribe(listener);
+
+    history.push("/modules/a");
+    history.replace("/modules/b");
+    window.dispatchEvent(new PopStateEvent("popstate"));
+    expect(listener).toHaveBeenCalledTimes(3);
+
+    unsubscribe();
+    window.dispatchEvent(new PopStateEvent("popstate"));
+    history.push("/modules/c");
+    expect(listener).toHaveBeenCalledTimes(3);
+  });
+
+  it("listens to popstate only while something is subscribed", () => {
+    const view = {
+      addEventListener: vi.fn(),
+      history: { pushState: vi.fn(), replaceState: vi.fn() },
+      location: { pathname: "/" },
+      removeEventListener: vi.fn(),
+    };
+    const history = createBrowserHostHistory(view);
+
+    const first = history.subscribe(() => undefined);
+    const second = history.subscribe(() => undefined);
+    expect(view.addEventListener).toHaveBeenCalledTimes(1);
+
+    first();
+    expect(view.removeEventListener).not.toHaveBeenCalled();
+    second();
+    expect(view.removeEventListener).toHaveBeenCalledTimes(1);
+    expect(view.removeEventListener.mock.calls[0]?.[1]).toBe(
+      view.addEventListener.mock.calls[0]?.[1],
+    );
+  });
+
+  it("stores no state object, so nothing a page put in history can be read back as authority", () => {
+    const view = {
+      addEventListener: vi.fn(),
+      history: { pushState: vi.fn(), replaceState: vi.fn() },
+      location: { pathname: "/" },
+      removeEventListener: vi.fn(),
+    };
+    const history = createBrowserHostHistory(view);
+
+    history.push("/modules/a");
+    history.replace("/modules/b");
+
+    expect(view.history.pushState).toHaveBeenCalledWith(null, "", "/modules/a");
+    expect(view.history.replaceState).toHaveBeenCalledWith(null, "", "/modules/b");
+  });
+});
+
+describe("the in-memory host history", () => {
+  it("behaves like the browser's: push truncates forward entries, go steps within bounds", () => {
+    const history = createMemoryHostHistory("/");
+    history.push("/modules/a");
+    history.push("/modules/b");
+    history.go(-1);
+    expect(history.pathname()).toBe("/modules/a");
+
+    history.push("/modules/c");
+    expect(history.entries).toEqual(["/", "/modules/a", "/modules/c"]);
+
+    history.go(-10);
+    expect(history.pathname()).toBe("/");
+    history.go(10);
+    expect(history.pathname()).toBe("/modules/c");
+  });
+});