docs(website): settle the nav interleave and the feature-provider seam

Records Phase 2 PR 8 of the module system: MODULE_SYSTEM.md gains the PR
entry in 2.7 and the built-it notes on 1.4 and 1.5; MODULE_API.md 3.3 is
amended where building it settled something the draft left open or got wrong.

The amendments to 3.3:

- The pipeline arrow had role/feature filtering BEFORE admin overrides. The
  code has always been the other way round, deliberately - the filter runs
  last so it stays a boundary an override cannot cross (THEMING_AND_NAV 7).
- `feature` was documented as public-area-only. It applies in all three
  areas: core's admin and player navs still carry no flags, but a module row
  that declares a gate and has it silently ignored is a trap.
- How a provider is found: by the module that registered the row, not by a
  prefix parsed out of the flag name. Core's own rows resolve against the
  owner id `core`, which core registers useShardFlags under.
- What a provider hook returns, and that every unknown fails OPEN.
- Why calling one hook per provider in a loop is legal, and why the
  enumerator is a module export rather than a member of registry.
- Six details the interleave settled: unordered rows append rather than
  defaulting to 0; an ungrouped admin row gets its own trailing group rather
  than joining core's; a module-created group is a legal override
  destination; a colliding `to` is dropped with a warning; and why the
  interleave must precede the override merge.

MOD_PATHS' replacement is recorded in both files, including the defect the
derivation fixed: the moderator redirect was a third hardcoded list that
disagreed with MOD_PATHS about /admin/houses. THEMING_AND_NAV 7's
"moderator confinement" note is amended to match.

Code: website PR 8 (client-only; 160 client tests, manifest and OpenAPI
unchanged), verified with the 7.7 browser smoke.

Co-Authored-By: Claude <noreply@anthropic.com>

website/THEMING_AND_NAV.md

@@ -536,10 +536,20 @@ Three existing behaviors the merge must not disturb:
   no menu. `pruneNav` applies the gate inside a section and then drops one it
   leaves empty.
 
-- **Moderator confinement.** `AdminLayout` restricts moderators to `MOD_PATHS` and
-  redirects them out of anything else. Overrides apply before that filter, so a
-  moderator can still end up with a legitimately short sidebar — but the redirect
-  effect must keep working untouched.
+- **Moderator confinement.** `AdminLayout` restricts moderators to the rows their
+  role carries and redirects them out of anything else. Overrides apply before
+  that filter, so a moderator can still end up with a legitimately short sidebar
+  — but the redirect effect must keep working untouched.
+
+  Amended by the module system's Phase 2 PR 8: this used to be a hardcoded
+  `MOD_PATHS` allowlist plus a second, differently-worded prefix check in the
+  redirect, and the two had drifted — `/admin/houses` was on the sidebar and not
+  in the redirect, so a moderator who clicked Houses was bounced to Moderation.
+  Both are now derived from each row's own `roles`
+  ([`adminNav.js`](../../website/client/src/lib/adminNav.js)), and the redirect
+  derives from the **base** nav rather than the merged one, which is what keeps
+  an override from moving the boundary in either direction. See
+  [`MODULE_SYSTEM.md`](MODULE_SYSTEM.md) §1.4.
 - **Empty groups.** `AdminLayout` drops groups whose items all filtered out. An
   override that hides every item in a group must produce no orphaned header.