Rebase services-as-hub-ia onto mobile-responsive-parity

Combine both branches into a single coherent branch:
- Full mobile responsive parity (useIsMobile, MobileCardRow, SheetForm,
  .mobile-touch-target, mobile cards, SheetForm forms, 44px targets,
  dirty-state confirm, TablePagination, refetchIntervalInBackground).
- Full services-as-hub IA (data-driven nav, service-page tab skeleton,
  new service types, Authentik directory + messaging, named dashboards,
  legacy routes 404, Observability split, Jellyseerr absorbed).

Enhancement: service tabs now use mobile-parity primitives:
- MediaTab: MobileCardRow below md (title/size/HDR/library/year) +
  TablePagination; DataTable at md+ (desktop branch preserved).
- FilesTab: MobileCardRow below md (name/type/size/modified) +
  handleRowClick; DataTable at md+.
- ServicePage: SheetForm branch below md (open-on-mount, sticky header
  + save bar, cancel navigates back to /services, dirty-state guard).
- Dashboard: single-column + section anchors below md (from mobile-parity)
  + empty-state CTA (from services-hub).
- App.tsx: useIsMobile() replaces inline matchMedia (from mobile-parity)
  + data-driven useNavItems (from services-hub).
- Backup tables (BackupAlerts/Jobs/Runs) already have MobileCardRow from
  mobile-parity; JobsTab inherits mobile behavior through its sub-components.

Conflict resolutions:
- Backend: entirely from services-hub (mobile didn't touch it).
- Deleted pages (Media/FileBrowser/Actions/Users/UsersPage/Applications/
  ObservabilityPage/BackupsPage + hooks/useUsers + tests): kept deleted
  (services-hub deleted them; content moved into service tabs).
- New service-tabs/*: from services-hub, enhanced with mobile patterns.
- App.tsx: services-hub's data-driven nav + mobile-parity's useIsMobile.
- Dashboard.tsx: merged (services-hub CTA + mobile-parity sections/anchors).
- ServicePage.tsx: services-hub's tab skeleton + mobile-parity's SheetForm.
- Primitives (useIsMobile/mobile-card/sheet-form/etc.): from mobile-parity.

117 frontend tests pass (mobile-parity's 122 - 5 deleted page tests +
services-hub's new tab/dashboard tests); 271 backend tests pass; lint/
build green both sides.

frontend/src/integrations/__tests__/navEntries.test.ts

@@ -0,0 +1,55 @@
+import { describe, it, expect } from "vitest";
+import { configuredNavEntries, SERVICE_TYPE_NAV_ENTRIES } from "../navEntries";
+
+describe("navEntries", () => {
+	it("returns no entries when no types are configured", () => {
+		expect(configuredNavEntries(new Set())).toEqual([]);
+	});
+
+	it("returns Media when jellyfin is configured", () => {
+		const entries = configuredNavEntries(new Set(["jellyfin"]));
+		expect(entries).toHaveLength(1);
+		expect(entries[0].label).toBe("Media");
+		expect(entries[0].path).toBe("/services/jellyfin");
+	});
+
+	it("returns Files + Actions when ssh_tasks is configured", () => {
+		const entries = configuredNavEntries(new Set(["ssh_tasks"]));
+		expect(entries).toHaveLength(2);
+		expect(entries.map((e) => e.label)).toEqual(["Files", "Actions"]);
+	});
+
+	it("returns all observability entries", () => {
+		const entries = configuredNavEntries(
+			new Set(["alertmanager", "grafana", "prometheus"]),
+		);
+		expect(entries.map((e) => e.label)).toEqual([
+			"Alerts",
+			"Grafana",
+			"Prometheus",
+		]);
+	});
+
+	it("returns Backups + Users when configured", () => {
+		const entries = configuredNavEntries(new Set(["backups", "authentik"]));
+		expect(entries.map((e) => e.label)).toEqual(["Backups", "Users"]);
+	});
+
+	it("nextcloud has no nav entries in the static map", () => {
+		expect(
+			SERVICE_TYPE_NAV_ENTRIES.filter((e) => e.serviceType === "nextcloud"),
+		).toEqual([]);
+	});
+
+	it("preserves declaration order across mixed types", () => {
+		const entries = configuredNavEntries(
+			new Set(["authentik", "ssh_tasks", "jellyfin"]),
+		);
+		expect(entries.map((e) => e.label)).toEqual([
+			"Media",
+			"Files",
+			"Actions",
+			"Users",
+		]);
+	});
+});

frontend/src/integrations/navEntries.ts

@@ -0,0 +1,91 @@
+/**
+ * Service-type → conditional nav-entry map.
+ *
+ * Each configured service type contributes one or more top-level nav entries
+ * that appear only when at least one enabled instance of that type exists.
+ * See OpenSpec change `services-as-hub-ia`, spec R1.2.
+ */
+import {
+	Activity,
+	DatabaseBackup,
+	FolderOpen,
+	GanttChartSquare,
+	Link2,
+	Monitor,
+	Users,
+	Zap,
+	type LucideIcon,
+} from "lucide-react";
+
+export interface NavEntry {
+	serviceType: string;
+	label: string;
+	icon: LucideIcon;
+	/** Route path for this entry. */
+	path: string;
+}
+
+/**
+ * Static mapping from service type to its conditional nav entries.
+ * `nextcloud` has no entries (no operational content).
+ */
+export const SERVICE_TYPE_NAV_ENTRIES: NavEntry[] = [
+	{
+		serviceType: "jellyfin",
+		label: "Media",
+		icon: Monitor,
+		path: "/services/jellyfin",
+	},
+	{
+		serviceType: "ssh_tasks",
+		label: "Files",
+		icon: FolderOpen,
+		path: "/services/ssh_tasks",
+	},
+	{
+		serviceType: "ssh_tasks",
+		label: "Actions",
+		icon: Zap,
+		path: "/services/ssh_tasks",
+	},
+	{
+		serviceType: "alertmanager",
+		label: "Alerts",
+		icon: Activity,
+		path: "/services/alertmanager",
+	},
+	{
+		serviceType: "grafana",
+		label: "Grafana",
+		icon: Link2,
+		path: "/services/grafana",
+	},
+	{
+		serviceType: "prometheus",
+		label: "Prometheus",
+		icon: GanttChartSquare,
+		path: "/services/prometheus",
+	},
+	{
+		serviceType: "backups",
+		label: "Backups",
+		icon: DatabaseBackup,
+		path: "/services/backups",
+	},
+	{
+		serviceType: "authentik",
+		label: "Users",
+		icon: Users,
+		path: "/services/authentik",
+	},
+];
+
+/**
+ * Filter the static entries to those whose service type is configured (present
+ * in the `configuredTypes` set). Returns a flat list in declaration order.
+ */
+export function configuredNavEntries(configuredTypes: Set<string>): NavEntry[] {
+	return SERVICE_TYPE_NAV_ENTRIES.filter((e) =>
+		configuredTypes.has(e.serviceType),
+	);
+}