Keep small SPA section navigation router-free

For a small authenticated SPA, shareable admin section URLs do not require a routing dependency: keep one explicit view↔path map, initialize from location.pathname, use pushState for navigation, and restore state from popstate. This preserves direct links and browser history while keeping query-string detail routes isolated. Observed 2026-09-08 from candidate-signal COR-4097 / PR #12 through focused unit coverage and local browser checks.