feat(intake): view-keys page + top nav for standalone-SHINES portal (Phase 2)

What + why

Phase 2 (P2.3) of epic &60 (closed). A read-only view-registered-keys page + top-of-page nav for the standalone-SHINES portal (today you can reach /report from keygen but not back, and there's no key list).

Plan: docs/modules/ROOT/pages/plans/craig-intake-portal-phase2-integration-aids.adoc (§ P2.3). Depends on P2.2 (the GET /signed/v1/keys proxy).

Design (see plan for detail)

• New keys.html + CSP-safe view-keys.js factory that fetches GET /signed/v1/keys and renders a table (kid, display name, status badge, created); Shines-only (reuse the keygen gate); empty + error states.
• Nav block on report.html / keygen.html / keys.html / status.html — Submit / Register a Key / View Keys / Check Status (keygen + view-keys links on Shines pages only). Styled with the Phase-1 nav a tokens.
• (Decided deviation from the brief: nav lives here with the page, not with the P2.2 endpoint — UI cohesion.)

Acceptance criteria

• Nav links present + navigable on the Shines pages; no raw hex (Phase-1 guard passes).
• /keys lists a key after register+approve; empty + error states render.
• e2e green (nav + view-keys page).