The /___refresh/:layout/:template/:oldRoute? route was registered
automatically at startup with no authentication or validation.

It called JSON.parse(queryParams.oldParams) on untrusted user input,
and passed :layout and :template params directly to this.render()
without checking they correspond to existing templates.

Use FlowRouter.reload() to reload the current route instead.

BREAKING CHANGE: FlowRouter.refresh(layout, template) is removed.

The previous implementation used a cascade of Meteor.setTimeout calls
(12ms → 24ms → 128ms → 256ms) with a waitFails counter that silently
reset after 9 failures. No timer cleanup was performed on exit.

Replace with:
- await Promise.all() for promise-based waitOn entries
- Tracker.autorun that re-runs reactively only when sub.ready() changes,
  resolving a Promise when all subscriptions are ready

This eliminates busy-waiting, removes the unpredictable timer cascade,
and integrates naturally with Meteor's reactivity system.

Client and server implementations duplicated ~300 lines of path
generation, route registration, group logic, and subscription handling.

Extract three shared base classes into lib/:
- RouterBase: path(), url(), group(), onRouteRegister(),
  _triggerRouteRegister(), common constructor state, client-only stubs
- RouteBase: subscription map (register, getSubscription,
  getAllSubscriptions, clearSubscriptions, callSubscriptions)
- GroupBase: full Group implementation (superset of client and server)

Server router now extends RouterBase and keeps only server-specific
methods: route(), matchPath(), setCurrent().
Server route and group are now thin wrappers around the base classes.

No behavior change — public API is identical.

page.js v1.9.0 (last commit 2019, ~2000 lines) is replaced by a
custom MicroRouter in lib/micro-router.js (~335 lines).

Improvements:
- No more monkey-patching of page.show / page.replace in initialize()
- Single decodeURIComponent — no double-decoding bug and no char-by-char
  double-encoding workaround in path generation
- Clean History API integration (pushState, replaceState, popstate)
- <a> click interception handles same-origin links only, with proper
  attribute checks (download, target, rel=external)
- No external dependency — pure ES2015 class, no npm package

server/router.js: matchPath() now uses pathToRegExp/matchPath from
lib/micro-router.js instead of page.Route, removing the last server-side
usage of page.js. Route patterns are compiled once and cached per route
object via a WeakMap.

package.js: removes page: '1.9.0' from Npm.depends.

BREAKING CHANGE: FlowRouter.initialize() no longer accepts a `page`
options object (page.js-specific options). The `hashbang`,
`decodeURLComponents`, and `window` options are removed.
`click` and `popstate` are still supported.

…erence

FlowRouter._qs was removed when page.js was replaced by MicroRouter.
pathFor() used FlowRouter._qs.parse() for query string parsing — now
imports qs directly from ./modules.js instead.