feat(modules): interleave module nav, derive moderator confinement

Phase 2, PR 8 of docs/website/MODULE_SYSTEM.md 2.7 - the nav half PR 7
deferred, plus the two seams 1.4 and 1.5 asked for.

withModuleNav (client/src/modules/nav.js) merges an installed module's rows
into core's three navs BEFORE the admin-override merge, and that ordering is
the design. applyNavOverrides and buildPublicNav are keyed by `to` and drop
any key their base array does not declare, so rows appended after the merge
would be unorderable, unrelabellable and unhideable in Admin - Navigation.
Today's UO rows are all three of those things, so appending would make the
extraction a visible regression for anyone who has ever edited their nav.
Merging first means a module row is an ordinary row downstream: nothing in
navOverrides.js, NavEditor.jsx or the layouts knows a module exists.

MOD_PATHS is gone. Moderator visibility and the redirect that confines a
moderator both derive from each row's own `roles`, in the new plain-JS
lib/adminNav.js (plain so the DOM-less runner can reach it). Two rows move,
both toward what the server already permitted: Dashboard, whose roles had
always named moderator, and My Characters, which is ungated self-service.

That also fixes a defect predating the module system. The redirect was a
THIRD hardcoded list - three path prefixes against MOD_PATHS' five paths -
and they disagreed about /admin/houses, so a moderator who clicked Houses in
their own sidebar was bounced back to Moderation. The derived allow-list is
computed from the BASE nav, never the override-merged one: an override is
presentation and must not move an authorization boundary either way.

The feature seam (modules/features.jsx + modules/featureGate.js) resolves a
row's `feature` against the provider its OWN module registered, so the
namespace comes from the registration and no string carries a parsed prefix.
Core registers useShardFlags under the owner id `core` - the client twin of
registries.registerCore() - so the ten shard-gated header rows already run
through the seam and Phase 3 deletes a registration instead of rewriting
SiteHeader. Every unknown fails open: no provider, a null answer while a
fetch is in flight, or a junk return all show the link, because the server is
the gate and hiding a page from someone entitled to it is the worse mistake.

933 server tests (unchanged - this PR is client-only), 160 client tests
(+37). routes.manifest.json unchanged at 230 routes; the OpenAPI spec
regenerates byte-identical.

Re-ran the MODULE_API.md 7.7 browser smoke, since this is the seam that rule
exists for. A throwaway module registering nav in all three areas and a
provider granting one flag and withholding another: the row lands inside
core's Moderation group rather than an appended block, the withheld row does
not render, a moderator reaches both /admin/houses and the module's admin
page, and an admin can relabel a module row and have it persist and apply.
Zero CSP reports, zero console errors.

Co-Authored-By: Claude <noreply@anthropic.com>

client/src/App.jsx

@@ -6,6 +6,7 @@ import RequireAuth from './components/RequireAuth.jsx'
 import RequirePlayer from './components/RequirePlayer.jsx'
 import RoleGate from './components/RoleGate.jsx'
 import { routesFor } from './modules/registry.js'
+import { ModuleFeaturesProvider } from './modules/features.jsx'
 
 // Public
 import Portal from './routes/public/Portal.jsx'
@@ -80,190 +81,198 @@ export default function App() {
   return (
     <AuthProvider>
       <SiteProvider>
-        <Routes>
-          {/* Landing hero — always public, even in maintenance mode. The hero is
-              itself the pre-launch "coming soon" page, so it sits outside the
-              MaintenanceGate and every visitor sees it regardless of auth/site mode. */}
-          <Route path="/" element={<Portal />} />
+        {/* Inside the auth and site contexts, because a feature provider is a
+            hook that may well read either — the shard one does, indirectly, by
+            asking an endpoint whose answer depends on the session. Outside the
+            routes, so the nav in every layout is filtered by the same gate and
+            the provider hooks are called once for the whole app rather than
+            once per screen. */}
+        <ModuleFeaturesProvider>
+          <Routes>
+            {/* Landing hero — always public, even in maintenance mode. The hero is
+                itself the pre-launch "coming soon" page, so it sits outside the
+                MaintenanceGate and every visitor sees it regardless of auth/site mode. */}
+            <Route path="/" element={<Portal />} />
 
-          {/* Rest of the public site — gated by maintenance mode (admins preview through it) */}
-          <Route
-            element={
-              <MaintenanceGate>
-                <Outlet />
-              </MaintenanceGate>
-            }
-          >
-            <Route path="/site" element={<Website />} />
-            <Route path="/site/news" element={<News />} />
-            <Route path="/site/screenshots" element={<Screenshots />} />
-            <Route path="/site/five-on-friday" element={<FiveOnFriday />} />
-            <Route path="/site/newsletter" element={<Newsletter />} />
-            <Route path="/site/newsletter/:id" element={<NewsletterIssue />} />
-            <Route path="/site/about" element={<About />} />
-            <Route path="/site/status" element={<Status />} />
-            <Route path="/site/shard" element={<Shard />} />
-            <Route path="/site/shard/activity" element={<ShardActivity />} />
-            <Route path="/site/champs" element={<ChampSpawns />} />
-            <Route path="/site/guilds" element={<Guilds />} />
-            <Route path="/site/governors" element={<Governors />} />
-            <Route path="/site/houses" element={<Houses />} />
-            <Route path="/site/rules" element={<Rules />} />
-            <Route path="/site/atlas" element={<Atlas />} />
-            <Route path="/site/atlas/:slug" element={<AtlasCreature />} />
-            <Route path="/site/leaderboards" element={<Leaderboards />} />
-            <Route path="/site/market" element={<Market />} />
-            <Route path="/site/market/vendors/:serial" element={<MarketVendor />} />
-            <Route path="/wiki" element={<Wiki />} />
-            <Route path="/wiki/:slug" element={<WikiArticle />} />
-            {/* Installed modules' public pages, namespaced `/<id>/…` — the
-                registry prefixes the segment, so a module cannot spell its way
-                out of it (docs/website/MODULE_API.md §3.3). Declared before the
-                CMS catch-all below: React Router ranks a static segment over a
-                dynamic one, so the order is not what saves us, but keeping the
-                two adjacent makes the relationship visible to whoever adds the
-                next route here. */}
-            {routesFor('public').map((r) => (
-              <Route key={r.path} path={`/${r.path}`} element={r.element} />
-            ))}
-            {/* CMS pages: top-level /:slug, matched only after the named routes
-                above (React Router ranks static routes over this dynamic one). */}
-            <Route path="/:slug" element={<CmsPage />} />
-          </Route>
-
-          {/* Draft-preview link (token-gated). Outside the maintenance gate so a
-              preview link works regardless of site mode. */}
-          <Route path="/preview/:id/:token" element={<CmsPage preview />} />
-
-          {/* Admin */}
-          <Route path="/admin/login" element={<AdminLogin />} />
-          <Route
-            path="/admin"
-            element={
-              <RequireAuth>
-                <AdminLayout />
-              </RequireAuth>
-            }
-          >
-            <Route index element={<Dashboard />} />
-            <Route path="posts" element={<PostsAdmin />} />
-            <Route path="pages" element={<PagesAdmin />} />
-            <Route path="pages/new" element={<PageBuilder />} />
-            <Route path="pages/:id" element={<PageBuilder />} />
-            <Route path="wiki" element={<WikiAdmin />} />
-            <Route path="hero" element={<HeroEditor />} />
-            {/* Theme editing writes an admin-only settings key; the route sits
-                behind the same RoleGate as the sidebar entry that reaches it,
-                and PUT/DELETE /admin/settings is admin-only server-side too. */}
+            {/* Rest of the public site — gated by maintenance mode (admins preview through it) */}
             <Route
-              path="appearance"
               element={
-                <RoleGate roles={['admin']}>
-                  <AppearanceAdmin />
-                </RoleGate>
-              }
-            />
-            {/* Same reasoning as Appearance: the nav overrides are an admin-only
-                settings key, so the route carries the same RoleGate as the
-                sidebar entry that reaches it. */}
-            <Route
-              path="navigation"
-              element={
-                <RoleGate roles={['admin']}>
-                  <NavEditor />
-                </RoleGate>
-              }
-            />
-            <Route path="settings" element={<SettingsAdmin />} />
-            <Route
-              path="moderation"
-              element={
-                <RoleGate roles={['admin', 'moderator']}>
+                <MaintenanceGate>
                   <Outlet />
-                </RoleGate>
+                </MaintenanceGate>
               }
             >
-              <Route index element={<Moderation />} />
-              <Route path="user/:discordId" element={<ModerationUser />} />
-              <Route path="appeals" element={<Appeals />} />
+              <Route path="/site" element={<Website />} />
+              <Route path="/site/news" element={<News />} />
+              <Route path="/site/screenshots" element={<Screenshots />} />
+              <Route path="/site/five-on-friday" element={<FiveOnFriday />} />
+              <Route path="/site/newsletter" element={<Newsletter />} />
+              <Route path="/site/newsletter/:id" element={<NewsletterIssue />} />
+              <Route path="/site/about" element={<About />} />
+              <Route path="/site/status" element={<Status />} />
+              <Route path="/site/shard" element={<Shard />} />
+              <Route path="/site/shard/activity" element={<ShardActivity />} />
+              <Route path="/site/champs" element={<ChampSpawns />} />
+              <Route path="/site/guilds" element={<Guilds />} />
+              <Route path="/site/governors" element={<Governors />} />
+              <Route path="/site/houses" element={<Houses />} />
+              <Route path="/site/rules" element={<Rules />} />
+              <Route path="/site/atlas" element={<Atlas />} />
+              <Route path="/site/atlas/:slug" element={<AtlasCreature />} />
+              <Route path="/site/leaderboards" element={<Leaderboards />} />
+              <Route path="/site/market" element={<Market />} />
+              <Route path="/site/market/vendors/:serial" element={<MarketVendor />} />
+              <Route path="/wiki" element={<Wiki />} />
+              <Route path="/wiki/:slug" element={<WikiArticle />} />
+              {/* Installed modules' public pages, namespaced `/<id>/…` — the
+                  registry prefixes the segment, so a module cannot spell its way
+                  out of it (docs/website/MODULE_API.md §3.3). Declared before the
+                  CMS catch-all below: React Router ranks a static segment over a
+                  dynamic one, so the order is not what saves us, but keeping the
+                  two adjacent makes the relationship visible to whoever adds the
+                  next route here. */}
+              {routesFor('public').map((r) => (
+                <Route key={r.path} path={`/${r.path}`} element={r.element} />
+              ))}
+              {/* CMS pages: top-level /:slug, matched only after the named routes
+                  above (React Router ranks static routes over this dynamic one). */}
+              <Route path="/:slug" element={<CmsPage />} />
             </Route>
-            <Route path="activity" element={<ActivityAdmin />} />
-            <Route path="bot-activity" element={<BotActivityAdmin />} />
-            <Route path="discord-bot" element={<DiscordBotAdmin />} />
-            <Route path="shard" element={<ShardAdmin />} />
-            <Route path="shard-visibility" element={<ShardVisibility />} />
-            <Route path="shard-atlas" element={<SpawnAtlasAdmin />} />
-            <Route
-              path="shard-ops"
-              element={
-                <RoleGate roles={['admin', 'moderator']}>
-                  <ShardOps />
-                </RoleGate>
-              }
-            />
-            <Route
-              path="houses"
-              element={
-                <RoleGate roles={['admin', 'moderator']}>
-                  <HousesAdmin />
-                </RoleGate>
-              }
-            />
-            <Route path="characters" element={<AdminCharacters />} />
-            <Route path="characters/:serial" element={<AdminCharacter />} />
-            <Route path="auth-providers" element={<AuthProvidersAdmin />} />
-            <Route path="users" element={<UsersAdmin />} />
-            <Route path="users/:id" element={<UserDetail />} />
-            <Route path="invites" element={<InvitesAdmin />} />
-            <Route path="account" element={<AccountAdmin />} />
-            {/* Installed modules' admin pages, at /admin/<id>/…, already inside
-                RequireAuth + AdminLayout. A module cannot supply its own auth
-                wrapper — only an optional { roles }, which core applies as the
-                same RoleGate its own routes above use, so the sidebar and the
-                route table cannot disagree about who may see what. Before the
-                `*` redirect, which would otherwise swallow every one of them. */}
-            {routesFor('admin').map((r) => (
-              <Route
-                key={r.path}
-                path={r.path}
-                element={r.gate ? <RoleGate roles={r.gate.roles}>{r.element}</RoleGate> : r.element}
-              />
-            ))}
-            <Route path="*" element={<Navigate to="/admin" replace />} />
-          </Route>
 
-          {/* Player portal */}
-          <Route path="/account/login" element={<PlayerLogin />} />
-          <Route path="/account/register" element={<PlayerRegister />} />
-          <Route path="/account/forgot" element={<ForgotPassword />} />
-          <Route path="/account/reset/:token" element={<ResetPassword />} />
-          <Route path="/invite/:token" element={<AcceptInvite />} />
-          <Route
-            element={
-              <RequirePlayer>
-                <PlayerPortalLayout />
-              </RequirePlayer>
-            }
-          >
-            <Route path="/player" element={<PlayerCharacters />} />
-            <Route path="/player/char/:serial" element={<PlayerCharacter />} />
-            <Route path="/account" element={<PlayerAccount />} />
-            <Route path="/account/appeals" element={<PlayerAppeals />} />
-            {/* Installed modules' player-portal pages, at /player/<id>/…. This
-                group's own routes are absolute (its layout route has no path),
-                so the prefix is written here rather than inherited — the one
-                place the three areas do not read alike. */}
-            {routesFor('player').map((r) => (
-              <Route
-                key={r.path}
-                path={`/player/${r.path}`}
-                element={r.gate ? <RoleGate roles={r.gate.roles}>{r.element}</RoleGate> : r.element}
-              />
-            ))}
-          </Route>
+            {/* Draft-preview link (token-gated). Outside the maintenance gate so a
+                preview link works regardless of site mode. */}
+            <Route path="/preview/:id/:token" element={<CmsPage preview />} />
 
-          <Route path="*" element={<Navigate to="/" replace />} />
-        </Routes>
+            {/* Admin */}
+            <Route path="/admin/login" element={<AdminLogin />} />
+            <Route
+              path="/admin"
+              element={
+                <RequireAuth>
+                  <AdminLayout />
+                </RequireAuth>
+              }
+            >
+              <Route index element={<Dashboard />} />
+              <Route path="posts" element={<PostsAdmin />} />
+              <Route path="pages" element={<PagesAdmin />} />
+              <Route path="pages/new" element={<PageBuilder />} />
+              <Route path="pages/:id" element={<PageBuilder />} />
+              <Route path="wiki" element={<WikiAdmin />} />
+              <Route path="hero" element={<HeroEditor />} />
+              {/* Theme editing writes an admin-only settings key; the route sits
+                  behind the same RoleGate as the sidebar entry that reaches it,
+                  and PUT/DELETE /admin/settings is admin-only server-side too. */}
+              <Route
+                path="appearance"
+                element={
+                  <RoleGate roles={['admin']}>
+                    <AppearanceAdmin />
+                  </RoleGate>
+                }
+              />
+              {/* Same reasoning as Appearance: the nav overrides are an admin-only
+                  settings key, so the route carries the same RoleGate as the
+                  sidebar entry that reaches it. */}
+              <Route
+                path="navigation"
+                element={
+                  <RoleGate roles={['admin']}>
+                    <NavEditor />
+                  </RoleGate>
+                }
+              />
+              <Route path="settings" element={<SettingsAdmin />} />
+              <Route
+                path="moderation"
+                element={
+                  <RoleGate roles={['admin', 'moderator']}>
+                    <Outlet />
+                  </RoleGate>
+                }
+              >
+                <Route index element={<Moderation />} />
+                <Route path="user/:discordId" element={<ModerationUser />} />
+                <Route path="appeals" element={<Appeals />} />
+              </Route>
+              <Route path="activity" element={<ActivityAdmin />} />
+              <Route path="bot-activity" element={<BotActivityAdmin />} />
+              <Route path="discord-bot" element={<DiscordBotAdmin />} />
+              <Route path="shard" element={<ShardAdmin />} />
+              <Route path="shard-visibility" element={<ShardVisibility />} />
+              <Route path="shard-atlas" element={<SpawnAtlasAdmin />} />
+              <Route
+                path="shard-ops"
+                element={
+                  <RoleGate roles={['admin', 'moderator']}>
+                    <ShardOps />
+                  </RoleGate>
+                }
+              />
+              <Route
+                path="houses"
+                element={
+                  <RoleGate roles={['admin', 'moderator']}>
+                    <HousesAdmin />
+                  </RoleGate>
+                }
+              />
+              <Route path="characters" element={<AdminCharacters />} />
+              <Route path="characters/:serial" element={<AdminCharacter />} />
+              <Route path="auth-providers" element={<AuthProvidersAdmin />} />
+              <Route path="users" element={<UsersAdmin />} />
+              <Route path="users/:id" element={<UserDetail />} />
+              <Route path="invites" element={<InvitesAdmin />} />
+              <Route path="account" element={<AccountAdmin />} />
+              {/* Installed modules' admin pages, at /admin/<id>/…, already inside
+                  RequireAuth + AdminLayout. A module cannot supply its own auth
+                  wrapper — only an optional { roles }, which core applies as the
+                  same RoleGate its own routes above use, so the sidebar and the
+                  route table cannot disagree about who may see what. Before the
+                  `*` redirect, which would otherwise swallow every one of them. */}
+              {routesFor('admin').map((r) => (
+                <Route
+                  key={r.path}
+                  path={r.path}
+                  element={r.gate ? <RoleGate roles={r.gate.roles}>{r.element}</RoleGate> : r.element}
+                />
+              ))}
+              <Route path="*" element={<Navigate to="/admin" replace />} />
+            </Route>
+
+            {/* Player portal */}
+            <Route path="/account/login" element={<PlayerLogin />} />
+            <Route path="/account/register" element={<PlayerRegister />} />
+            <Route path="/account/forgot" element={<ForgotPassword />} />
+            <Route path="/account/reset/:token" element={<ResetPassword />} />
+            <Route path="/invite/:token" element={<AcceptInvite />} />
+            <Route
+              element={
+                <RequirePlayer>
+                  <PlayerPortalLayout />
+                </RequirePlayer>
+              }
+            >
+              <Route path="/player" element={<PlayerCharacters />} />
+              <Route path="/player/char/:serial" element={<PlayerCharacter />} />
+              <Route path="/account" element={<PlayerAccount />} />
+              <Route path="/account/appeals" element={<PlayerAppeals />} />
+              {/* Installed modules' player-portal pages, at /player/<id>/…. This
+                  group's own routes are absolute (its layout route has no path),
+                  so the prefix is written here rather than inherited — the one
+                  place the three areas do not read alike. */}
+              {routesFor('player').map((r) => (
+                <Route
+                  key={r.path}
+                  path={`/player/${r.path}`}
+                  element={r.gate ? <RoleGate roles={r.gate.roles}>{r.element}</RoleGate> : r.element}
+                />
+              ))}
+            </Route>
+
+            <Route path="*" element={<Navigate to="/" replace />} />
+          </Routes>
+        </ModuleFeaturesProvider>
       </SiteProvider>
     </AuthProvider>
   )