put the settings section in the url

Five settings pages moved from a `*_SELECTED` global to `/settings/:page/:section`. The
sidebar entry is a react-router `<NavLink>` rather than a button holding the key in its
onClick closure, so a section is linkable, cmd-clickable and gets its active state from the
router; each page renders one `SettingsRoute` guard that canonicalises both the bare route
and a section that does not exist.

Integrations needed more than the shared factory. It builds its own sidebar, and it kept the
Enterprise/Personal tab in a second global — which is why a deep link to a Personal section
could never have worked: the link set the section, the tab stayed on Enterprise, and the
content pane said "Select a section" about a section that existed. The tab is derived from
the section key now.

Also removes the `/settings/resources` menu item (audit M8) and its two locale keys: there
has never been such a route, so it bounced to the catch-all and out to `/`.

docs/workspace-panel-todo.md

@@ -634,6 +634,19 @@ All the same bug: an app guessing "am I being closed?" from an unmount, or payin
       (`frontend.tsx:15-21`) with no per-route scoping, and `reset` is called nowhere.
       Authority: `docs/navigation-audit.md`.
 
+      **Settings is done** (audit M6). Five pages moved to `/settings/:page/:section`: the section is
+      `useParams`, the sidebar entry is a `<NavLink>` instead of a `<button>` with the key in its closure,
+      and each page renders one `SettingsRoute` guard that canonicalises the bare route and an unknown
+      section. Six globals went with it — the five `*_SELECTED` keys and `INTEGRATIONS_SETTINGS_TAB`.
+      Two things the doc's "one fix point" framing had wrong. Integrations does **not** go through
+      `createSettingsPanelComponents` — it builds its own sidebar, so it needed its own conversion. And
+      its Enterprise/Personal tab was a *second* global, which is why deep-linking a Personal section
+      could never have worked: the link set the section, the tab stayed on Enterprise, and the content
+      pane rendered "Select a section" for a section that existed. The tab is derived from the section
+      key now, so there is nothing left to disagree with.
+      Remaining here: Music, Soulseek, SystemMonitor, Email, Browser. **Chat detail
+      (`chat:selected-session`) is chat-owned — leave it; it is written up in `COMMS/`.**
+
 ### 5.9 The context has grown an app-config section — _(found 2026-08-07)_
 
 `WorkspaceContext` is 18 fields, of which the framework itself reads none of the first six. Apps never