docs(website): phase 10 — public nav sections and added links, and the §7 amendment

Records the capability asked for before the edge -> main cutover: dropdown
sections in the public header, with the coded entries organised into them and
admin-authored links alongside.

§7 is amended rather than quietly contradicted. It said the override layer
"cannot introduce a `to` that is not already in the hardcoded NAV array"; that
remains true of every CODED entry, and the restated constraint spells out what an
added link may be — a same-origin path, carrying no gate of its own, advertising
a route rather than granting one — plus why the property is structural: coded
entries live in a map keyed by routes the base array declares, and everything
that can name an arbitrary path lives in `links`, where the rule is applied.

§6.4 gains the { items, sections, links } wrapper, including the two properties
worth knowing: a bare map still reads as the items map, and a nav with no
sections still stores one.

§9 gains three acceptance criteria — the empty dropdown does not render, an added
link cannot leave the origin, and deleting a section returns its entries to the
top level rather than removing them.

"Phase 10 as landed" records why the Public tab needed its own tree editor, why
moving between containers stayed a dropdown rather than a cross-container drag,
why the menu opens on click and its trigger is not a link, and the palette-vs-full-nav
bug this surfaced in the phase 6-8 save path.

Co-Authored-By: Claude <noreply@anthropic.com>

website/BACKEND_DESIGN.md

@@ -301,6 +301,19 @@ accepted (the editor sends it mid-edit) but never stored, so hiding stays
 subtractive. `hidden` on `/admin/navigation` is dropped for `nav_admin`, because
 that screen is the only UI that can un-hide anything.
 
+**`nav_public` may also carry dropdown sections and admin-authored links**, as
+`{ items, sections, links }` — a bare map still reads as `items`, and a nav with
+no sections still stores one. A **section** has a label and a position and no
+route at all: it only opens, so it adds no reachable surface. A **link** is the
+one place a path may be named that the code does not declare, and is therefore
+the one place the path rule applies: same-origin only, no scheme and no
+protocol-relative `//host`. A link carries no gate of its own and needs none —
+the page behind it enforces its own access, so an added link advertises a route
+and never grants one. Coded entries stay in `items`, keyed by a route the base
+array must declare, which is what keeps "an override cannot introduce a route"
+structurally true. Sections and links are dropped for `nav_admin` / `nav_player`,
+whose layouts cannot render them.
+
 **`theme_visual` is resolved server-side, not shipped raw to the browser.**
 `utils/themeResolve.js` layers `:root` ← preset ← custom, field by field, into
 the CSS custom properties `getPublic()` returns as `theme`; the SPA's only job