Feat v0.9.1 server-side sub-path routing

Hardens multi-surface routing: unified root/catch-all dispatcher,
aggregateAccess() early auth short-circuit for all-authenticated
packages, SDK history.replaceState() for back-button resilience.

13 new tests (5 aggregateAccess unit + 8 handler integration).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -2,6 +2,50 @@
 
 All notable changes to Armature are documented here.
 
+## v0.9.1 — Server-Side Sub-Path Routing
+
+Hardens multi-surface routing so full-page refreshes on sub-paths work
+correctly server-side, with early auth optimization and back-button
+resilience.
+
+**Route consolidation**
+
+- Root (`/s/:slug`) and catch-all (`/s/:slug/*path`) handlers now share
+  a single `dispatch` function. The root handler injects `path="/"` and
+  delegates, eliminating the separate code path.
+
+**Early auth short-circuit**
+
+- New `aggregateAccess()` function scans all surfaces to determine
+  whether a package is all-public, all-authenticated, or mixed.
+- All-authenticated packages redirect to login before surface matching,
+  skipping `matchSurface()` + `evaluateAccess()` overhead.
+- Mixed-access packages fall through to per-surface checks as before.
+
+**SDK back-button fix**
+
+- On boot, `history.replaceState()` seeds the initial history entry
+  with `__SURFACE_PATH__` and `__SURFACE_PARAMS__`. This fixes
+  back-button navigation from `sw.navigate()` to the initial
+  server-rendered view.
+- SDK version bumped to `0.9.1`.
+
+**Tests: 13 new**
+
+- 5 `aggregateAccess` unit tests (all-public, all-auth, mixed,
+  default-access, single-public).
+- 8 handler integration tests covering root refresh, sub-path static
+  and param refresh, unauth redirect, public anonymous, mixed-access,
+  non-matching sub-path, and early auth short-circuit.
+
+**Modified files:**
+
+- `server/pages/pages.go` — `aggregateAccess()`, route consolidation,
+  early auth short-circuit in `RenderExtensionSurface`
+- `server/pages/pages_surface_match_test.go` — 5 new unit tests
+- `server/pages/pages_handler_test.go` — 8 new integration tests
+- `src/js/sw/sdk/index.js` — `history.replaceState()` seed, version bump
+
 ## v0.9.0 — Multi-Surface Packages
 
 Packages can now declare multiple surfaces — each with its own path, access