panel-redesign: ratchet list, fixture registry and a route seam for the guards

Groundwork the guard tests of stage 0 stand on; no behaviour changes.

  - internal/web/view/legacy_pages.txt: the redesign ratchet. Every page of
    today's panel is listed as still old, plus @kit and @routes for the two
    pieces of work whose tests stay quiet until they land. The list only
    shrinks (enforced by CI in the next commits).
  - internal/web/view/fixtures_test.go: the registry of fixtures the guards
    render redesigned pages with. Empty until the kit page exists.
  - web.go: route registration moves out of Handler() into muxes(), so a
    test can ask the real muxes which pattern answers a path.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/web.go

@@ -147,6 +147,17 @@ func (s *Server) Start() error {
 
 // Handler returns the panel's HTTP handler (router).
 func (s *Server) Handler() http.Handler {
+	mux, authed := s.muxes()
+	mux.Handle("/", s.auth.RequireAuth(authed))
+	return s.secure(mux)
+}
+
+// muxes registers every route: the public ones, and the ones behind a session.
+// Both muxes are flat — one pattern per route, nothing mounted as a sub-router —
+// and building them only takes method values, it never calls into s.auth or
+// s.handlers: the route guard test (guard_routes_test.go) runs this on a bare
+// Server and asks each mux which pattern answers a path.
+func (s *Server) muxes() (public, authed *http.ServeMux) {
 	mux := http.NewServeMux()
 	h := s.handlers
 
@@ -157,7 +168,7 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("/login", s.auth.HandleLogin)
 	mux.HandleFunc("/logout", s.auth.HandleLogout)
 
-	authed := http.NewServeMux()
+	authed = http.NewServeMux()
 	authed.HandleFunc("GET /{$}", redirectHome)
 	authed.HandleFunc("GET /help", h.HandleHelp)
 
@@ -224,8 +235,7 @@ func (s *Server) Handler() http.Handler {
 	authed.HandleFunc("GET /system-log", h.HandleSystemLog)
 	authed.HandleFunc("GET /system-log/body", h.HandleSystemLogBody)
 
-	mux.Handle("/", s.auth.RequireAuth(authed))
-	return s.secure(mux)
+	return mux, authed
 }
 
 // redirectSettings sends legacy /account bookmarks to /settings (308 preserves POST).