feat(shell): make module pages first-class top-level routes

Module pages move from `/modules/<id>` to `/<module-id>` (`/signage`),
beside `/settings` and `/account`, so the implementation concept
"module" never appears in a user-facing address. ADR 0057 is rewritten
to match.

- Core reserves the top-level names the platform actually serves today
  (`account`, `api`, `assets`, `display`, `settings`), and discovery
  refuses a module that declares one with `MODULE_ID_RESERVED`. That
  covers startup, `modules:validate`, and package verification. Tests in
  `apps/api` hold the set to every top-level route the API registers and
  every page the shell interprets.
- The API serves the Dashboard page at `/<module-id>` and below only for
  modules discovered with a Dashboard UI, enabled or not: a disabled
  module's bookmark still opens the Dashboard, which says it is
  unavailable. An arbitrary root path such as
  `/definitely-not-a-real-module` stays the sanitized 404.
- Both reference proxies forward every top-level path shaped like a
  module id and let the API decide; the split Dashboard hostname still
  refuses `/api`, `/display`, and `/assets`. Installing a module needs no
  proxy change.
- `/<module-id>/<page>` is already served and forwarded, so a later
  module sub-page contract needs no routing or deployment change; the
  shell shows "Page not found" there until it exists.
- The deploy smoke checks a module's address before install, while
  installed, while disabled, after removal, and after reinstall, plus
  unknown names and the old `/modules/…` form through the real proxy.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

surfaces/shell/tests/host-app.test.tsx

@@ -287,7 +287,7 @@ describe("Ekklesia shell — browser authentication", () => {
   // These tests exercise a mounted module, so each opens the default fixture's own page, exactly as
   // its deep link would (ADR 0057). The Dashboard root is the Overview and mounts nothing.
   beforeEach(() => {
-    window.history.replaceState(null, "", "/modules/example");
+    window.history.replaceState(null, "", "/example");
   });
   it("renders only a neutral loading state until principal resolves and fetches no navigation early", async () => {
     let releasePrincipal: (() => void) | undefined;
@@ -563,7 +563,7 @@ describe("Ekklesia shell — logout and session expiration", () => {
   // These tests exercise a mounted module, so each opens the default fixture's own page, exactly as
   // its deep link would (ADR 0057). The Dashboard root is the Overview and mounts nothing.
   beforeEach(() => {
-    window.history.replaceState(null, "", "/modules/example");
+    window.history.replaceState(null, "", "/example");
   });
   it("unmounts module UI and closes realtime before completing server-side logout", async () => {
     let releaseSignOut: (() => void) | undefined;
@@ -938,7 +938,7 @@ describe("Ekklesia shell — Dashboard navigation", () => {
     await render(
       { apiBaseUrl, fetch: platformFetch({ groups: [mediaGroup(), planningGroup()] }) },
       async () => artifact("livestream", "2.0.0"),
-      "/modules/livestream",
+      "/livestream",
     );
 
     expect(query("select-livestream")?.getAttribute("aria-current")).toBe("page");
@@ -954,7 +954,7 @@ describe("Ekklesia shell — Dashboard navigation", () => {
         requested.push(url);
         return artifact(url.includes("/calendar/") ? "calendar" : "video", "0.1.0");
       },
-      "/modules/video",
+      "/video",
     );
 
     await act(async () => {
@@ -1015,7 +1015,7 @@ describe("Ekklesia shell — mount lifecycle", () => {
   // These tests exercise a mounted module, so each opens the default fixture's own page, exactly as
   // its deep link would (ADR 0057). The Dashboard root is the Overview and mounts nothing.
   beforeEach(() => {
-    window.history.replaceState(null, "", "/modules/example");
+    window.history.replaceState(null, "", "/example");
   });
   it("keeps fixed shell tracks while module content changes size", async () => {
     await render({ apiBaseUrl, fetch: platformFetch() }, async () => artifact("example", "0.1.0"));
@@ -1188,7 +1188,7 @@ describe("Ekklesia shell — failure is host-owned", () => {
   // These tests exercise a mounted module, so each opens the default fixture's own page, exactly as
   // its deep link would (ADR 0057). The Dashboard root is the Overview and mounts nothing.
   beforeEach(() => {
-    window.history.replaceState(null, "", "/modules/example");
+    window.history.replaceState(null, "", "/example");
   });
   it("renders its own error when the artifact cannot be imported", async () => {
     await render({ apiBaseUrl, fetch: platformFetch() }, async () => {