spike(modules): carry /public/atlas/* behind the proposed module surface

THROWAWAY BRANCH — evidence for the Phase 1 contract, never merged. See
modules/uo/SPIKE.md and docs/website/MODULE_API.md Part 7.

The six public spawn-atlas routes now live in modules/uo/, reached only through
the ctx/register surface, with the client half loading as a prebuilt ESM chunk.
All three exit criteria met:

  • zero internal-file imports from the module into core; the built chunk has
    zero bare import specifiers and bundles no React
  • routes.manifest.json AND routes.guards.json are byte-identical
  • /uo/atlas renders from /modules/uo/entry.js under script-src 'self' with
    zero CSP violation reports

729 core tests and 81 module tests pass. Verified end to end against the real
database: the schema fragment replays after core's, onBoot runs the atlas
refresh, and the six API URLs answer unchanged.

Two things the spike changed in the contract:

  • ctx.express / ctx.validator. A module lives outside server/, so Node never
    reaches server/node_modules and require('express') fails outright — the
    server-side twin of the one-React rule, which §2.6 had only for the client.
  • window.__rg.jsxRuntime, so a module can build with the automatic JSX
    runtime its tooling already assumes rather than being forced to classic.

And it confirmed §6.1 empirically: regenerating the OpenAPI spec silently
deleted all 361 lines of the atlas paths with "Swagger-autogen: Success", while
the route manifest kept all six in the same run. That is exactly the
static-analysis-vs-runtime split the fragment merge exists to prevent.

Co-Authored-By: Claude <noreply@anthropic.com>

client/src/components/SiteHeader.jsx

@@ -7,6 +7,7 @@ import { useSite } from '../contexts/SiteContext.jsx'
 import { useShardFeatures, canSee } from '../lib/useShardFeatures.js'
 import NavDropdown from './NavDropdown.jsx'
 import { buildPublicNav, pruneNav } from '../lib/navOverrides.js'
+import { navFor } from '../modules/registry.js'
 import { parseJsonSetting } from '../lib/settingsJson.js'
 
 // One consistent top nav for the whole public site. Every page gets the same
@@ -33,7 +34,6 @@ export const NAV = [
   { label: 'Governors', to: '/site/governors', feature: 'governors' },
   { label: 'Houses', to: '/site/houses', feature: 'houses' },
   { label: 'Rules', to: '/site/rules', feature: 'ruleset' },
-  { label: 'Atlas', to: '/site/atlas', feature: 'atlas' },
   { label: 'Leaderboards', to: '/site/leaderboards', feature: 'leaderboards' },
   { label: 'Market', to: '/site/market', feature: 'market' },
   { label: 'About', to: '/site/about' },
@@ -61,10 +61,26 @@ export default function SiteHeader() {
   //     never opens onto nothing;
   //   • with no stored row this is the coded NAV, in code order, so an
   //     untouched instance renders exactly what it renders today.
+  // Installed modules' entries interleave into this list by `order` BEFORE the
+  // override merge, so an admin edits one nav rather than "core's, plus whatever
+  // the module appended" — and a module item is hideable and re-labelable
+  // exactly like a core one. `order` defaults high, which lands module entries
+  // where the UO items already sat: after the content links, before About.
+  const base = useMemo(() => {
+    const items = navFor('public')
+    if (items.length === 0) return NAV
+    const merged = [...NAV]
+    for (const item of items) {
+      const at = Number.isFinite(item.order) ? item.order : merged.length
+      merged.splice(Math.min(at, merged.length), 0, { label: item.label, to: item.to, feature: item.feature })
+    }
+    return merged
+  }, [])
+
   const nav = useMemo(() => {
-    const tree = buildPublicNav(NAV, parseJsonSetting(settings.nav_public))
+    const tree = buildPublicNav(base, parseJsonSetting(settings.nav_public))
     return pruneNav(tree, (item) => !item.feature || canSee(shardFeatures, item.feature))
-  }, [settings.nav_public, shardFeatures])
+  }, [base, settings.nav_public, shardFeatures])
 
   // Where the auth entry points: staff → admin, player → portal, else sign in.
   let account