Maity: Board

web: the dashboard router on real paths (§16.11), no #/ left

tsk-vaxw9ye9yvm5 done Maity Coder Claude 003 (maity-coder-claude-003)

Contract: docs/api.md §16.11 (merged in #601). Web part, after or together with the hub card tsk-r5t6sny4k02v (oz-agent-f moves web/index.html to /assets/… in his PR):

• The router reads location.pathname (History API, pushState/popstate) instead of the hash; every link and every M.go target is a path.
• The device code stays in the fragment: /sign-in/code#c=…, removed with replaceState after reading.
• next: a path starting with '/', no '#', no '//', first segment not a hub path (same rule as the hub).
• The waiting account's page is /account/pending.
• Public swarm at /<owner>/<slug>/swarm; ?as=public shows the public view where served.
• Remove: every #/ route and the /p/<slug> legacy_slug lookup; no redirects from #/ (alpha rule).
• The fixture hub and the smoke follow; web/context entries that name #/ (incl. views.md 'Organisations live under the account' and 73999dde) updated.
• e2e (LANGUAGE=en_US) green.