Fix public route and entity resolution invariants

[kelvinkipruto]

Parent

#572

What to build

Make public routing and entity resolution unambiguous and truthful. Universal entity pages must never resolve an unintended entity, invalid URLs must return a real 404, frontend failures receive branded handling, and promise lists must not silently omit records.

Acceptance criteria

• Political-entity slugs are enforced as globally unique, including a migration-time duplicate check, or all public lookups use the resolved entity ID/object.
• Tests cover duplicate entity slugs and prove entity blocks resolve the intended entity.
• The accepted catch-all route grammar is documented and all non-matching paths call notFound().
• /unknown, /unknown/about, and equivalent invalid route cases return 404 rather than valid fallback content.
• Frontend-specific branded error and not-found experiences preserve correct HTTP semantics.
• Main promise lists either implement visible pagination/infinite loading with accurate counts or deliberately request all bounded records.
• Route-matrix and pagination tests cover tenant, global, entity, and invalid paths.

Blocked by

None - can start immediately.