port(upstream#1883): replaceState for traces/roles redirects so Back works

[adminopenclaw8-sketch]

"Split out of #25 (commit fa90d887 there). This branch holds exactly one upstream change so it can be reviewed, tested and reverted on its own.\n\n## Upstream\n- PR: Kpa-clawbot/CoreScope#1883 by @Jonher937, merged 2026-09-02\n- Upstream commit: a46a6d55eb7912e1f917af35c33f6de28429e09e\n- Applied with git cherry-pick -x onto master fda24ca5; upstream authorship kept, and the commit message carries the (cherry picked from commit …) line.\n- Patch-id identical to the #25 commit and to the upstream commit.\n- Scope: public/app.js.\n\n## Problem\nThe backward-compat redirects #/traces/<hash> → #/tools/trace/<hash> and #/roles → #/analytics?tab=roles assigned location.hash, which pushes a history entry. Pressing Back landed on the old hash, which redirected forward again, trapping the user.\n\n## Change\nBoth redirects use history.replaceState(...) followed by navigate(), so the redirect replaces the current entry instead of adding one.\n\n## Adaptation to this fork\nNone. The cherry-pick applied without conflicts and the changed lines are identical to upstream.\n\n## Dependencies and merge order\n- Independent. Branched directly from master fda24ca5 and needs no other PR from this split.\n- A merge simulation of all 24 split PRs gives the same tree in upstream order and in reverse order.\n- The same simulation also merges cleanly with each of the open #11, #13 and #22, and with #33 (opened during this split; it makes TestPruneOldNeighborMetrics deterministic). If #33 lands first, the expected CI failure named below disappears; nothing in this PR depends on it.\n- Recommended position: 10 of 24, following upstream's merge order (the order #25 was assembled in).\n\n## Verification\nLocal run of the same commands as CI's “Go Build & Test” job (server tests with -race), on this branch and on master fda24ca5 under the same conditions (same machine, run one after another):\n\n| Check | master fda24ca5 | this branch | verdict |\n|---|---|---|---|\n| xss-gate-diff | PASS | PASS | |\n| channel-lib-test | PASS | PASS | |\n| decrypt-cli-build-test | PASS | PASS | |\n| dockerfile-copy-invariants | FAIL | FAIL | not runnable locally: script needs bash ≥4 (declare -A), macOS has 3.2; identical on master |\n| staging-disk-monitor | PASS | PASS | |\n| css-vars-lint | PASS | PASS | |\n| JS unit tests from CI list + AGENTS.md set (67 files) | see below | 63 PASS, 4 FAIL | |\n| test-issue-1375-scope-stats-fetch.js | FAIL | FAIL Exactly one api('/scope-stats' call exists (the fixed loader) — found 2 | baseline failure, unchanged |\n| test-issue-1648-m4-emoji-scan.js | FAIL | FAIL map.js has 1 emoji/misc-icon hit(s): | baseline failure, unchanged |\n| test-a11y-axe-routes-coverage.js | FAIL | FAIL axe ROUTES missing analytics tabs (issue #1706): areas, foreign-traffic, wardriving | baseline failure, unchanged |\n| test-frontend-helpers.js | FAIL | FAIL favStar returns empty star for non-favorite: The expression evaluated to a falsy value:, favStar returns filled star for favorite: The expression evaluated to a falsy value: | baseline failure, unchanged |\n\nBaseline failures (fail identically on master; not introduced or changed here): see rows marked baseline failure, unchanged.\n\nBrowser validation (local, fixture DB, no staging/production): Local Go server (built from master) on the committed E2E fixture DB (freshened, migrated and seeded exactly like CI), serving this branch's public/, compared side by side with the same server serving master's public/. From #/nodes, set location.hash = '#/roles', then history.back(). master: redirect lands on #/analytics?tab=roles but history grows by 2, and Back stays on #/analytics?tab=roles (the trap). this branch: lands on #/analytics?tab=roles with the Roles tab active, history grows by 1 (only the user's own navigation), and Back returns to #/nodes with the nodes table rendered.\n\nNot run:\n- Playwright E2E suites (no local Playwright install); CI's E2E job will also be skipped, see below.\n- eslint (not installed locally; CI installs it on the fly).\n- Go -race/tests for modules this PR does not touch (unchanged code, identical to master).\n- Browser tests against staging/production (deliberately none).\n\nExpected GitHub CI: “Go Build & Test” is expected to fail on TestPruneOldNeighborMetrics, which already fails on master (see #25's run). Downstream jobs (Playwright, image build) are therefore skipped. “Deploy Staging” and all GHCR publish steps only run on push to master and cannot run for this PR.\nTwo further ingestor tests have failed intermittently in this split's CI on branches whose cmd/ingestor tree is byte-identical to master (#27, #28), so they can also appear here without being caused by this change:\n- TestBackfillTxLastSeen_ResolvesFromMaxObservationTimestamp: also reproduced locally on unmodified master.\n- TestMQTTStallWatchdog_DisconnectedEscalationThrottled_1749: the suite flake that upstream Kpa-clawbot#2003 (also split out of #25) addresses.\n\nGitHub CI result: run 34750402107 on 1d20c29f. Go Build & Test: failure; all downstream jobs incl. Deploy Staging skipped. Failed tests:\n - TestPruneOldNeighborMetrics: fails on master, documented baseline\n - TestBackfillTxLastSeen_ResolvesFromMaxObservationTimestamp: intermittent, reproduced on unmodified master locally\n\n🤖 Generated with Claude Code\n\n## Update — current master 693eb04 (2026-09-17)\n\nThe existing PR branch was updated without force-push from 1d20c29f to e218de15. The merge graph preserves the original upstream-attributed commit, incorporates green master 693eb045dbb10ecdd4657444134a696f007297e1, and includes the verified local prep commit a6980c74.\n\nThe PR diff against current master is limited to public/app.js, test-issue-1883-redirect-history.js, and its registration in test-all.sh. All CI fixes already on master, including the 150-minute E2E timeout and new a11y/UI registrations, are preserved.\n\n### Fresh verification on e218de1\n\n- node --check public/app.js: PASS\n- node test-issue-1883-redirect-history.js: 4/4 PASS, including Back navigation for traces, roles, query parameters, and legacy routes\n- Test registration check: PASS\n- git diff --check: PASS\n\nNo staging, production, deployment, workflow, or auto-merge action was performed. GitHub PR CI: run 35220087380 completed successfully. Go/build gates and Playwright E2E passed. The Docker job performed only the local staging build; GHCR login/push, release artifacts, staging deploy, and badge publication were skipped.\n\n"