Feat v0.9.1 server-side sub-path routing

Hardens multi-surface routing: unified root/catch-all dispatcher,
aggregateAccess() early auth short-circuit for all-authenticated
packages, SDK history.replaceState() for back-button resilience.

13 new tests (5 aggregateAccess unit + 8 handler integration).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/pages/pages_surface_match_test.go

@@ -168,6 +168,57 @@ func TestFindNavSurface_NoMatch(t *testing.T) {
 	}
 }
 
+// ── aggregateAccess tests ──────────────────────────────────
+
+func TestAggregateAccess_AllPublic(t *testing.T) {
+	surfaces := []any{
+		map[string]any{"path": "/", "access": "public"},
+		map[string]any{"path": "/submit", "access": "public"},
+	}
+	if got := aggregateAccess(surfaces); got != "public" {
+		t.Errorf("expected public, got %s", got)
+	}
+}
+
+func TestAggregateAccess_AllAuthenticated(t *testing.T) {
+	surfaces := []any{
+		map[string]any{"path": "/", "access": "authenticated"},
+		map[string]any{"path": "/admin", "access": "admin"},
+	}
+	if got := aggregateAccess(surfaces); got != "authenticated" {
+		t.Errorf("expected authenticated, got %s", got)
+	}
+}
+
+func TestAggregateAccess_Mixed(t *testing.T) {
+	surfaces := []any{
+		map[string]any{"path": "/submit", "access": "public"},
+		map[string]any{"path": "/dashboard", "access": "authenticated"},
+	}
+	if got := aggregateAccess(surfaces); got != "mixed" {
+		t.Errorf("expected mixed, got %s", got)
+	}
+}
+
+func TestAggregateAccess_DefaultAccess(t *testing.T) {
+	// No access field → defaults to "authenticated"
+	surfaces := []any{
+		map[string]any{"path": "/"},
+	}
+	if got := aggregateAccess(surfaces); got != "authenticated" {
+		t.Errorf("expected authenticated (default), got %s", got)
+	}
+}
+
+func TestAggregateAccess_SinglePublic(t *testing.T) {
+	surfaces := []any{
+		map[string]any{"path": "/", "access": "public"},
+	}
+	if got := aggregateAccess(surfaces); got != "public" {
+		t.Errorf("expected public, got %s", got)
+	}
+}
+
 // ── evaluateAccess tests ────────────────────────────────────
 // Note: evaluateAccess depends on gin.Context which is hard to unit test
 // without a full Gin setup. These are covered via handler integration tests.