Unify nav: merge Admin+Notifications into Dashboard, fold API Tokens into Profile

- Replace the separate Profile/API Tokens nav items with a single link
  showing the logged-in user's name, pointing at their own profile.
- Merge admin.ejs + notifications.ejs into a new dashboard.ejs page.
  /admin and /notifications now 301-redirect to /dashboard.
- Fold the API Tokens page into profile.ejs as a self-service-only
  section, gated on isOwnProfile so it never appears when an admin
  views another user's profile via /users/:uid. /api-tokens 301s to /.
- Fix: the section must not carry class="row" — app-base.js runs a
  page-wide $('div.row').fadeIn() on every page load that would reveal
  it regardless of the isOwnProfile check, since it fires before this
  page's own gating logic.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

nodejs/routes/index.js

@@ -44,13 +44,14 @@ router.get('/tos', function(req, res) {
   res.render('tos', {...values, tosHtml});
 });
 
-router.get('/admin', function(req, res) {
-  res.render('admin', {...values});
+// Admin dashboard (stats + recent/inactive users) and Notifications
+// (broadcast + history) merged into one page.
+router.get('/dashboard', function(req, res) {
+  res.render('dashboard', {...values});
 });
 
-router.get('/notifications', function(req, res) {
-  res.render('notifications', {...values});
-});
+router.get('/admin', (req, res) => res.redirect(301, '/dashboard'));
+router.get('/notifications', (req, res) => res.redirect(301, '/dashboard'));
 
 router.get('/invites', function(req, res) {
   res.render('invites', {...values});
@@ -77,9 +78,8 @@ router.get('/oauth-clients', function(req, res, next) {
   res.render('oauth_clients', {...values, issuer, discoveryUrl: `${issuer}/.well-known/openid-configuration`});
 });
 
-router.get('/api-tokens', function(req, res, next) {
-  res.render('api_tokens', {...values});
-});
+// API Tokens is now a section on the Profile page (own profile only).
+router.get('/api-tokens', (req, res) => res.redirect(301, '/'));