fix(frontend): the layer gates cover what the move left outside them, and each page keeps its own logic

Gates the folder move had narrowed or left open: the MenuCheck contract scans the whole app again (it
saw only components/); local/layers refuses an import of an entry (main.tsx, the /watch page) from
any layer, and reads a backtick import() as the path it is; the /watch contract forbids the shell,
the modules and the features by folder (its one path to App had gone stale); chunkGuard's own test
gets the vitest focus/skip rules. The root tests' exemption from local/layers is in the gate
register, with its three imports.

Placement: Plex's chip builder moves into lib beside the feed's, the folder names into
features/folders, and three files only one page uses into that page. ui/FilterRail takes its reset
from useRail instead of a page id. The channel page reads the feed's view and builds "Show in feed"
itself, and the feed's scroll key is the feed's hook, so the shell holds no feed logic.

The floating header re-measures when one page's pills replace another's in the same commit (the
claim count stayed equal, so only the observer caught it). A Plex view applied and edited now stays
across a visit to another page, as the feed's does: pinned by a test. docs/development.md says what a
page with a rail adds in lib.

frontend/src/watchEntry.contract.test.ts

@@ -18,13 +18,19 @@ const FORBIDDEN: Record<string, string> = {
   i18next: "the app's i18n runtime",
   "react-i18next": "the app's i18n runtime",
   "@tanstack/react-query": "the app's data layer",
-  "src/App.tsx": "the app shell",
   "src/main.tsx": "the app's entry",
   "src/lib/notifications.ts": "the app's notification center",
   "src/lib/logHooks.ts": "the app's client-log wiring",
   "flag-icons": "the app's flag sprites",
   [DYNAMIC]: "an import() of a computed path — no walk can say what it loads",
 };
+// …and the app's layers above the platform, by folder, so a file moved or added inside one is still
+// forbidden (a single path to the shell's App went stale when App moved).
+const FORBIDDEN_DIRS: Record<string, string> = {
+  "src/shell/": "the app shell",
+  "src/modules/": "an app page",
+  "src/features/": "the app's shared features",
+};
 
 function resolveSpec(from: string, spec: string): string | null {
   if (spec === DYNAMIC) return DYNAMIC;
@@ -100,6 +106,9 @@ describe("the /watch entry", () => {
     const leaks = Object.keys(FORBIDDEN)
       .filter((mod) => seen.has(mod))
       .map((mod) => `${FORBIDDEN[mod]}: ${chain(seen, mod)}`);
+    for (const mod of seen.keys())
+      for (const [dir, what] of Object.entries(FORBIDDEN_DIRS))
+        if (mod.startsWith(dir)) leaks.push(`${what}: ${chain(seen, mod)}`);
     expect(leaks).toEqual([]);
   });
 
@@ -109,6 +118,7 @@ describe("the /watch entry", () => {
     const app = reach(join(SRC, "main.tsx"));
     expect(app.has("src/i18n/index.ts")).toBe(true);
     expect(app.has("src/components/legal/Terms.tsx")).toBe(true);
+    expect([...app.keys()].some((m) => m.startsWith("src/shell/"))).toBe(true);
   });
 
   it("serves the same head as the app's page, so the server's OG block lands the same way", () => {