feat(header): add WordPress-style header navigation modules

[queball1999]

Summary

Adds a header navigation menu: two new base modules, plus the engine and editor pieces they need.

What changed

• base.nav (Header Navigation): A nav bar that collapses below an author-chosen width into a dropdown or a full-screen overlay, behind a pickable toggle icon. Props: collapse width (presets or any number), collapsed style, menu icon and icon colour, menu alignment, menu background.
• base.nav-item (Menu Item): A menu entry that nests to any depth, so the page tree is the menu structure. With Enable link off, the label is a static element; on an item with a submenu, the label itself toggles the submenu.
• instanceCss on render() output: CSS that depends on an instance's props, deduplicated by content. base.nav uses it for the media query at its collapse width.
• canvasCss on ModuleDefinition: A stylesheet for a trusted module's editor component, injected where the publisher puts module CSS (after the reset and framework CSS, before class and user CSS).
• canvasViewportWidth on ModuleComponentProps: The pixel width of the breakpoint frame a component renders in.
• Property controls: A number control can offer presets; a select whose options carry iconSvg renders as an icon button row.

Fixes to shared editor controls, found while building the menu

• URL fields could only be pasted into. Typing snapped back on every keystroke, because only complete valid URLs were stored and the field always showed the stored value. The field now keeps what is being typed and stores it once valid.
• URL fields rejected links the publisher emits. They now accept site-relative links (/about, #pricing, ?page=2, ./a, ../a) and tel: / sms:.
• The data-binding button covered the switch thumb on every toggle control. It now sits to the left of the switch.

Why

There was no way to build a responsive site menu without hand-writing the markup, CSS and script. The engine additions exist because the menu needs three things the module contract did not have: CSS that varies per instance, a canvas preview that follows the same cascade as the published page, and knowledge of the frame width in the canvas.

Impact

• Users: two new modules under "Navigation". URL fields in Button, Link and Menu Item can be typed into and accept relative, tel: and sms: links. The bind-to-data button no longer overlaps toggles.
• Developers: instanceCss, canvasCss, canvasViewportWidth, number presets and select iconSvg are available to first-party modules. presets and iconSvg are also exposed through the plugin SDK control builders. Plugin modules cannot return instanceCss or declare canvasCss.
• Published output: nav classes are all prefixed instatic-nav. Menu panels fall back to the Canvas system colour when no menu background is set.
• No database or migration changes.

Verification

• bun run build
• bun test locally on Windows: 7096 passed, 48 failed. No failures are in tests this PR adds or changes; they are scan timeouts and Windows-only path and symlink failures. Relying on CI for the full pass.
• bun run lint
• Docker/deployment check, if relevant. Not relevant here: no Dockerfile or compose changes.

Checklist

• Tests cover behavior changes.
• Docs were updated when behavior, config, deployment, or public surfaces changed.
• No compatibility shim was added for old pre-release behavior.
• No secrets, local databases, uploads, or generated artifacts are included.