hub: back-button replaceState trapdoor + hamburger resize-safety

Codex audit polish:
- Cold deep-link Back now goto('/home3', { replaceState: true }) instead of
  pushing a new entry, so the browser Back from the hub can't bounce the reader
  straight back into the detail page. In-app arrivals still history.back().
- HubBar closes the hamburger when crossing to desktop width (matchMedia change),
  so `open` can't go stale and reappear if the viewport shrinks back to mobile.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/components/HubBar.svelte

@@ -5,6 +5,15 @@
   let { active = '' } = $props();
   let open = $state(false);
 
+  // Close the menu when we cross into desktop width, so it can't linger open and reappear
+  // if the viewport shrinks back to mobile (the CSS hide alone left `open` stale).
+  $effect(() => {
+    const mq = window.matchMedia('(min-width: 721px)');
+    const sync = (e) => { if (e.matches) open = false; };
+    mq.addEventListener('change', sync);
+    return () => mq.removeEventListener('change', sync);
+  });
+
   const LINKS = [
     { key: 'home', href: '/home3', label: 'Home' },
     { key: 'news', href: '/', label: 'News' },

frontend/src/lib/components/HubShell.svelte

@@ -12,7 +12,9 @@
   afterNavigate(({ from }) => { if (from) cameFromApp = true; });
   function goBack() {
     if (cameFromApp && typeof history !== 'undefined') history.back();
-    else goto('/home3');
+    // Cold deep-link: no in-app origin. REPLACE this entry rather than pushing one, so the
+    // browser Back from the hub doesn't bounce the reader straight back into the detail page.
+    else goto('/home3', { replaceState: true });
   }
 </script>