Let the owner manage categories, and give the menus a shelf

Categories were baked into config/<site>.site.json, so adding one meant a
rebuild and a redeploy. They are now data: data/sections.json, seeded from the
config the first time, and managed in the admin (add, rename, reorder, remove).
A category's web address is fixed when it is created because that is what a QR
code points at, and a category cannot be removed while it still holds menus.

The landing and the top bar were the ugliest parts. The landing was a column of
hairlines with tiny meta — a broadsheet, and the paper that makes this app worth
looking at was nowhere on it. It is now a shelf: each category is a row whose
right edge is a sliver of that menu's first page, bleeding off the screen, with
the shelf edge in brass and the name in heavy tight Archivo. The bar was a row
of teal pills that would not survive more categories: it now names the menu you
are reading and opens a sheet listing the rest, each with its own paper sliver,
and the current one is the only teal thing on screen. The sheet is a link to the
landing page, so navigating still works without the script.

Also fixes the category manager's own layout, which I shipped unstyled, and the
markup contract the route tests described.

docs/operating.md

@@ -12,7 +12,8 @@ For whoever is on the other end of "the menu is wrong". The design is in
 | Menu content | `/var/lib/menu-app.<site>/data` — `originals/`, `drafts/`, `published/` |
 | Admin | `https://<vhost>/admin` |
 | The password | `/var/lib/menu-app.<site>/site.env` (mode 600, never in git) |
-| Sections and branding | `config/<site>.site.json` in this repo, baked into the image |
+| Categories | `data/sections.json`, edited in the admin |
+| Brand and theme | `config/<site>.site.json` in this repo, baked into the image |
 
 ## Everyday tasks
 
@@ -31,9 +32,15 @@ bash /tmp/provision-site-env.sh /var/lib/menu-app.hopsngrains.com --force
 docker restart menu-app.hopsngrains.com
 ```
 
-**Add, rename or reorder a Section.** Edit `config/<site>.site.json`, rebuild and
-push (`./deploy.sh <tag>`), then run the playbook with the new tag. Sections are
-deliberately not editable from the admin (ADR 0005).
+**Add, rename, reorder or remove a category.** In the admin, open the
+**Categories** fold at the bottom of the dashboard. A new category starts empty,
+so customers do not see it until you publish a menu into it. Reordering there is
+the order customers see. Two rules: a category's web address is fixed when it is
+created (rename the name as often as you like — a printed QR code keeps working),
+and a category can only be removed once it holds no menus.
+
+**Change brand or theme.** Edit `config/<site>.site.json`, rebuild and push
+(`./deploy.sh <tag>`), then run the playbook with the new tag.
 
 **Fix a missing image.** If a Page's thumbnail or viewing image is lost while its
 Original survives, the app can rebuild them: