feat(shell): give every Dashboard page a real URL

The Dashboard had one address. The API served the page only at `/`, both
reference proxies forwarded only `/`, and the open module lived in React
state, so a refresh went back to the first module, nothing could be
bookmarked, and Back left the Dashboard (DESIGN.md §2.7).

ADR 0057 makes the address bar the source of truth:

- `/` is a host-owned Overview, now the landing page; `/modules/<id>`
  mounts that module. An id the server's navigation does not list shows
  "This page isn't available" and loads nothing; any other Dashboard
  address is a host-owned "Page not found".
- `/modules`, `/settings`, and `/account` are reserved whole, from one
  list (`@ekklesia/shell/dashboard-routes`) that the shell's router and
  the API's page routes both read. The API serves the same frozen page,
  ETag, and security headers anywhere inside them; look-alikes and other
  methods stay the sanitized 404.
- A small host-owned history replaces the selected-module state, built in
  the entry point so it stays the only file touching `window`. Navigation
  items are real links; modified clicks are left to the browser. Focus
  moves to the page after an in-place change, and the tab is named after
  the page.
- Sign-in still happens in place with no return value (ADR 0034), so a
  deep link opens its own page after sign-in.
- Both reference Caddyfiles forward the new paths; the deploy smoke now
  reloads a module's address through the real proxy and requires it to
  mount again.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tests/deploy.test.ts

@@ -188,7 +188,12 @@ describe("reference deployment compose files", () => {
       .filter((line) => !line.trim().startsWith("#"))
       .join("\n");
 
-    expect(directives).toContain("@ekklesia path / /api/* /display/* /assets/*");
+    // The Dashboard's reserved namespaces (ADR 0057, `DASHBOARD_PAGE_PREFIXES` in
+    // `surfaces/shell/src/dashboard-routes.ts`), each both bare and with everything below it, so a
+    // refreshed deep link reaches the API instead of the proxy's 404.
+    expect(directives).toContain(
+      "@ekklesia path / /api/* /display/* /assets/* /modules /modules/* /settings /settings/* /account /account/*",
+    );
     expect(directives).toContain("header_up X-Forwarded-For {client_ip}");
     expect(directives).toContain("header_up -CF-Connecting-IP");
     expect(directives).toContain("trusted_proxies static {$EKKLESIA_TUNNEL_ADDRESS}/32");
@@ -200,6 +205,22 @@ describe("reference deployment compose files", () => {
   });
 });
 
+describe("split-origin reference proxy", () => {
+  it("serves the Dashboard's page, its deep links, and its script on the Dashboard hostname, and no API", async () => {
+    const caddyfile = await text("Caddyfile.split.example");
+    const directives = caddyfile
+      .split("\n")
+      .filter((line) => !line.trim().startsWith("#"))
+      .join("\n");
+
+    expect(directives).toContain(
+      "@dashboard path / /assets/ekklesia-dashboard/* /modules /modules/* /settings /settings/* /account /account/*",
+    );
+    // The API hostname still serves no Dashboard page at all.
+    expect(directives).toContain("@api path /api/* /display/* /assets/ekklesia-display/*");
+  });
+});
+
 describe("reference deployment env examples", () => {
   it("contain no secret values", async () => {
     const secretKeys = new Map([