feat(web): Certificates and Access under Organization, dark-only UI

[BRAVO68WEB]

Summary

`main` was missing the dashboard IA from `3ecb2262` (it sat on `feat/landing-nav-ia` after #134 merged). Restore it:

• Product switcher is Secrets | Organization (Certificates is not a third product).
• Organization sidebar: Certificates + GPG, then Users / Teams / Roles (Access tabs removed).
• Landing and dashboard force dark (no theme toggle).

Verify

On `main` before this PR: `core-modules.ts` still had a Certificates product group and a single Access item. After: Users/Teams/Roles nav items and cert paths map to product `organization`.

Program / phase

• N/A

No-piggyback checklist

• Does not make product A depend on product B via spawn, re-export, or rename-only API
• Shared code is a library (kernel/domain/ui), not a second entrypoint of another product
• If this creates or provisions an organization, it matches the channel matrix (§1.1a)
• Self-host web session never gains a new org-create path
• New enterprise API/UI modules are registered for the enterprise package path (not only silently inside core forever) — note follow-up phase if interim
• OSS deploy changes do not call into `deploy-cli` / enterprise deploy sources

Tests

• Mock / unit (if API)
• E2E or pack smoke (if behavior/deploy)
• N/A docs-only

`shell-context.test.ts` and `core-modules.test.ts` pass. Routes E2E uses sidebar nav instead of Access tabs.

Risk / rollout

Dashboard IA change. Needs a web-static rebuild after merge (v0.22.0 images were built without this).