feat(theme): upstream router controls and responsive shell fixes

ZB.MOM.WW.Theme/README.md

@@ -65,7 +65,8 @@ server-side** before redirecting (open-redirect risk):
 | `NavRailSection` | `Title`*, `Expanded` (default `true`), `ChildContent` | CSS-only collapsible `<details>` group; no JS, works in static SSR. |
 | `StatusPill` (`StatusState`) | `State`* (`Ok`/`Warn`/`Bad`/`Idle`/`Info`), `ChildContent` | Inline chip. `StatusState` enum is in `ZB.MOM.WW.Theme`. |
 | `LoginCard` | `Product`*, `Action` (default `/auth/login`), `ReturnUrl`, `Error`, `ChildContent` | Static form-POST sign-in card. Inject `<AntiforgeryToken/>` via `ChildContent`; validate `ReturnUrl` server-side. |
-| `TechButton` (`ButtonVariant`) | `Variant` (`Primary`/`Secondary`/`Danger`/`Ghost`), `Type`, `Busy`, `ChildContent`, splatted attrs | `Busy` disables the button and shows a spinner. `ButtonVariant` enum is in `ZB.MOM.WW.Theme`. |
+| `TechButton` (`ButtonVariant`, `ButtonSize`) | `Variant` (`Primary`/`Secondary`/`Danger`/`Ghost`), `Size` (`Default`/`Small`/`Large`), `Class`, `Type`, `Busy`, `ChildContent`, splatted attrs | `Busy` disables the button and shows a spinner. Caller classes are composed with required variant/size classes. |
+| `TreeTable<TRow>` (`ITreeRow`) | `Rows`*, `Head`*, `Row`*, `Label`*, `Collapsed`, `OnToggle` | Stateless preorder tree table. The caller filters visible rows and owns expansion state. |
 | `TechCard` | `Title`, `Header`, `ChildContent`, `Footer`, `Class` | Panel with optional head/body/footer slots. |
 | `TechField` | `Label`*, `Hint`, `Error`, `ChildContent` | Form field wrapper with label, hint text, and inline error. |
 
@@ -80,7 +81,7 @@ Served at `_content/ZB.MOM.WW.Theme/…` by the ASP.NET static-web-asset pipelin
 | Path | Contents |
 |---|---|
 | `css/theme.css` | Design tokens (`--accent`, `--ok`, `--warn`, …), typography, utility helpers |
-| `css/layout.css` | Side-rail shell layout, collapsible nav, `StatusPill` variants, card/field helpers, Bootstrap `.btn` sizing |
+| `css/layout.css` | Side-rail shell layout, collapsible nav, `StatusPill` variants, card/field helpers, Bootstrap `.btn` sizing, shared page/group headers, badges, row actions, info notices, payload blocks and tree-table styles |
 
 **Bootstrap button sizing (new in 0.4.0).** The kit now normalizes `.btn` / `.btn-sm` against its
 0.9rem body via `--bs-btn-*` variable overrides, because Bootstrap hard-codes
@@ -128,6 +129,52 @@ so a token-block edit re-themes the whole kit.
 ```bash
 # from ZB.MOM.WW.Theme/
 dotnet build -c Release   # TreatWarningsAsErrors — expect 0 warnings
-dotnet test               # 38 bUnit tests
-./build/pack.sh           # → ./artifacts/ZB.MOM.WW.Theme.0.1.0.nupkg
+dotnet test               # 60 tests verified for 0.5.0
+./build/pack.sh           # → ./artifacts/ZB.MOM.WW.Theme.0.5.0.nupkg
 ```
+
+## 0.5.0 migration (published 2026-11-04)
+
+The tested package was published to the shared Gitea feed on 2026-11-04.
+An independent feed download exactly matched the reviewed artifact (SHA256
+`374511ebaaa15be71024051e896c8e7e59a8951b0d51a990fa48fbe378ac6485`).
+The ignitionoee router deployed this package to CR on 2026-11-04; other consumer
+rollouts remain separate. It retains the 0.4.2 `.rise` animation
+fill-mode fix. The published package is immutable; this source documentation
+update does not repack or replace it.
+
+The shell now keeps page content visible when mobile navigation is collapsed.
+The outer disclosure's `::details-content` wrapper is dissolved at every width;
+an explicit mobile closed-state selector hides only the rail. Author display
+rules retain the page for older browsers without `::details-content` support.
+The menu remains a native keyboard-accessible disclosure without custom JavaScript.
+Mobile pages are constrained to the shell width so wide tables scroll inside their
+table wrapper instead of widening the whole document.
+
+The remaining ignitionoee `app.css` rules now ship in `layout.css`: page and section
+headers/meta, group headings/meta, count badges, `.notice.info`, `.row-actions`,
+**`td.row-actions`**, and `.check-data`. Consumers may delete matching local copies
+after adopting this package. The element-qualified row-action selector must remain:
+the bare class loses to `.data-table td` regardless of stylesheet load order.
+
+Use `Size="ButtonSize.Small"` or `Size="ButtonSize.Large"` on `TechButton`.
+`Class="my-action"` and an attribute dictionary's `class` value are composed with
+the required button classes. A lowercase `class` supplied in Razor binds to `Class`
+as normal Blazor parameter binding. Supplying both spellings as separate component
+parameters is unnecessary; use `Class` plus `AdditionalAttributes` when merging two
+sources. Explicit `Busy` and `Type` continue to control the underlying attributes.
+
+Implement `ZB.MOM.WW.Theme.ITreeRow` on a consumer's row model (`Key`, `Depth`,
+`HasChildren`). Feed `TreeTable<TRow>` visible rows in preorder, with each subtree
+contiguous after its parent. `Head` supplies all header cells; `Row` supplies cells
+after the component's name cell; `Label` supplies the name. `OnToggle` reports the
+stable row key, and the caller supplies a new `Collapsed` state and filters `Rows`.
+The component never filters or mutates caller state. Indentation supports arbitrary
+depth through `--tt-depth`; styles ship once, with no per-instance stylesheet.
+Leaf controls preserve label alignment and omit subtree ARIA attributes. Interactive
+expand/collapse requires an interactive Blazor host and Bootstrap Icons for chevrons.
+
+The test harness uses bUnit 2.7.2 and directly pins AngleSharp 1.5.0. This avoids
+the vulnerable parser minimum ([GHSA-pgww-w46g-26qg](https://github.com/advisories/GHSA-pgww-w46g-26qg))
+and the binary incompatibility between bUnit 1.x and the patched parser. These
+dependencies belong to the test project; the Theme runtime package gains none.