Fix trust-signing setup workspace branding

src/Web/StellaOps.Web/src/app/features/trust-admin/trust-admin.component.ts

@@ -25,7 +25,7 @@ const TRUST_ADMIN_TABS: readonly TrustAdminTab[] = ['keys', 'issuers', 'certific
       <header class="trust-admin__header">
         <div class="trust-admin__title-row">
           <div>
-            <p class="trust-admin__eyebrow">Administration</p>
+            <p class="trust-admin__eyebrow">{{ workspaceLabel() }}</p>
             <h1>Trust Management</h1>
             <p class="trust-admin__lede">
               Manage signing keys, trusted issuers, mTLS certificates, and view audit logs.
@@ -397,6 +397,7 @@ export class TrustAdminComponent implements OnInit {
   readonly error = signal<string | null>(null);
   readonly summary = signal<TrustDashboardSummary | null>(null);
   readonly activeTab = signal<TrustAdminTab>('keys');
+  readonly workspaceLabel = signal<'Setup' | 'Administration'>('Setup');
 
   // Computed
   readonly alertCount = computed(() => this.summary()?.expiryAlerts?.length ?? 0);
@@ -453,7 +454,12 @@ export class TrustAdminComponent implements OnInit {
   }
 
   private setActiveTabFromUrl(url: string): void {
-    const path = url.split('?')[0].split('/').filter(Boolean).pop() ?? 'keys';
+    const segments = url.split('?')[0].split('/').filter(Boolean);
+    const routeRoot = segments[0];
+    const path = segments.at(-1) ?? 'keys';
+
+    this.workspaceLabel.set(routeRoot === 'administration' ? 'Administration' : 'Setup');
+
     if (TRUST_ADMIN_TABS.includes(path as TrustAdminTab)) {
       this.activeTab.set(path as TrustAdminTab);
     } else {

src/Web/StellaOps.Web/tests/e2e/prealpha-canonical-full-sweep.spec.ts

@@ -194,7 +194,7 @@ const strictRouteExpectations: Partial<Record<(typeof canonicalRoutes)[number],
   },
   '/setup/trust-signing': {
     title: /Trust/i,
-    texts: ['Trust Management'],
+    texts: ['Setup', 'Trust Management'],
   },
   '/ops/policy': {
     title: /Policy/i,