Hardens multi-surface routing: unified root/catch-all dispatcher,
aggregateAccess() early auth short-circuit for all-authenticated
packages, SDK history.replaceState() for back-button resilience.
13 new tests (5 aggregateAccess unit + 8 handler integration).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>