feat(shell): make module pages first-class top-level routes

Module pages move from `/modules/<id>` to `/<module-id>` (`/signage`),
beside `/settings` and `/account`, so the implementation concept
"module" never appears in a user-facing address. ADR 0057 is rewritten
to match.

- Core reserves the top-level names the platform actually serves today
  (`account`, `api`, `assets`, `display`, `settings`), and discovery
  refuses a module that declares one with `MODULE_ID_RESERVED`. That
  covers startup, `modules:validate`, and package verification. Tests in
  `apps/api` hold the set to every top-level route the API registers and
  every page the shell interprets.
- The API serves the Dashboard page at `/<module-id>` and below only for
  modules discovered with a Dashboard UI, enabled or not: a disabled
  module's bookmark still opens the Dashboard, which says it is
  unavailable. An arbitrary root path such as
  `/definitely-not-a-real-module` stays the sanitized 404.
- Both reference proxies forward every top-level path shaped like a
  module id and let the API decide; the split Dashboard hostname still
  refuses `/api`, `/display`, and `/assets`. Installing a module needs no
  proxy change.
- `/<module-id>/<page>` is already served and forwarded, so a later
  module sub-page contract needs no routing or deployment change; the
  shell shows "Page not found" there until it exists.
- The deploy smoke checks a module's address before install, while
  installed, while disabled, after removal, and after reinstall, plus
  unknown names and the old `/modules/…` form through the real proxy.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

scripts/lib/deploy-smoke-browser.mjs

@@ -231,7 +231,7 @@ if (hasModule) {
   // Dashboard page there, and the shell mounts the same module again (ADR 0057).
   const moduleUrl = await evaluate("location.href");
   check(
-    moduleUrl === `${dashboardOrigin}/modules/${moduleId}`,
+    moduleUrl === `${dashboardOrigin}/${moduleId}`,
     "opening the module put its own address in the address bar",
   );
   await navigate(moduleUrl);

scripts/lib/deploy-smoke-client.mjs

@@ -88,8 +88,9 @@ async function edgeChecks() {
     "the Dashboard page names the API's origin, rendered at run time (ADR 0045)",
   );
 
-  // Every Dashboard page answers with that same page, so a refresh stays put (ADR 0057).
-  for (const deepLink of ["/modules/example", "/settings/displays/add", "/account"]) {
+  // Every Dashboard page answers with that same page, so a refresh stays put (ADR 0057). No module
+  // is installed yet at this point; a module's own address is reloaded in a real browser later.
+  for (const deepLink of ["/settings", "/settings/displays/add", "/account"]) {
     const deepPage = await fetch(`${dashboardOrigin}${deepLink}`);
     check(
       deepPage.status === 200 &&
@@ -98,10 +99,15 @@ async function edgeChecks() {
       `GET ${deepLink} through the proxy is the same Dashboard page`,
     );
   }
-  check(
-    await refusedByProxy(`${dashboardOrigin}/settings-old`),
-    "a look-alike of a Dashboard namespace is refused by the proxy",
-  );
+  // A top-level name shaped like a module id reaches the API, which knows the installed modules and
+  // answers anything that is not a Dashboard page with its sanitized 404 — never the page.
+  for (const unknown of ["/definitely-not-a-real-module", "/settings-old", "/modules/example"]) {
+    const response = await fetch(`${dashboardOrigin}${unknown}`);
+    check(
+      response.status === 404 && (await response.text()) === '{"code":"NOT_FOUND"}',
+      `GET ${unknown} through the proxy is the API's sanitized 404, not a Dashboard page`,
+    );
+  }
 
   const script = await fetch(`${dashboardOrigin}/assets/ekklesia-dashboard/app.js`);
   await script.arrayBuffer();
@@ -510,6 +516,25 @@ async function moduleChecks() {
     check(installed, `the module inventory lists the \`${moduleId}\` module`);
   }
 
+  // The module's own Dashboard address (ADR 0057) exists exactly while the module is installed with a
+  // Dashboard UI — disabled or not: the Dashboard page when it is, the API's sanitized 404 when it is
+  // not. A disabled module is not running, but its address still opens the Dashboard.
+  const pageExpectation =
+    optional("SMOKE_MODULE_PAGE") || (expectation === "absent" ? "absent" : "served");
+  const modulePage = await fetch(`${dashboardOrigin}/${moduleId}`);
+  const modulePageBody = await modulePage.text();
+  if (pageExpectation === "absent") {
+    check(
+      modulePage.status === 404 && modulePageBody === '{"code":"NOT_FOUND"}',
+      `GET /${moduleId} is the sanitized 404 while the module is not installed`,
+    );
+  } else {
+    check(
+      modulePage.status === 200 && modulePageBody.includes('id="ekklesia-host"'),
+      `GET /${moduleId} through the proxy is the Dashboard page while the module is installed`,
+    );
+  }
+
   if (moduleId === "example") {
     const records = await fetch(`${apiOrigin}/api/v1/modules/example/records`, { headers });
     if (expectation === "absent") {

scripts/smoke-deploy.sh

@@ -543,9 +543,13 @@ recreate_api() {
   fi
 }
 
-# module_check <expectation>: "absent", or the exact JSON array of values `example` must return.
+# module_check <expectation> [page]: "absent", or the exact JSON array of values `example` must
+# return. `page` is whether its Dashboard address is served (ADR 0057): by default, exactly when the
+# module is running; "served" for a module that is installed but disabled, whose address still opens
+# the Dashboard so it can say the module is unavailable.
 module_check() {
   client module --ip "$module_client_address" -e SMOKE_MODULE_EXPECT="$1" \
+    -e SMOKE_MODULE_PAGE="${2:-}" \
     -e SMOKE_MODULE_ID="$module_id" -e SMOKE_MODULE_PROBE_PATH="$module_probe_path" \
     -e SMOKE_OWNER_EMAIL="$owner_email" -e SMOKE_OWNER_PASSWORD="$owner_password"
 }
@@ -729,7 +733,7 @@ if [[ "$topology" == split ]]; then
   step "Disabling and re-enabling the module through the supported lifecycle command"
   restart_api "${compose[@]}" run --rm --no-deps migrate node \
     core/dist/cli/set-module-enabled.js --disable --module "$module_id"
-  module_check absent || fail "the disabled module was still reported as running."
+  module_check absent served || fail "the disabled module was still reported as running."
   module_storage "test -d /modules/${module_id}" ||
     fail "disabling the module removed its installed package."
   restart_api "${compose[@]}" run --rm --no-deps migrate node \