I have been looking around a lot for info on the voltages used on this module, but I have found very conflicting results.
Basically my question is:
If the module (for example on ebay) is listed as "supply voltage 3.0-3.6V", does this mean I have to use that voltage range for all pins, or just the Vcc pin? Can it take 5V on the CE/CSN/MOSI/MISO etc?
Just the Vcc pin. The data pins are 5V tolerant. Exceed 3.6V on Vcc, and you will likely kill the module, however.
Pico is quite correct here, but I'd like to mention that I did run one of mine with VDD=5V by accident, for a few minutes, and it shows no ill effects. Not that I'd recommend it -- I got lucky.
It is well worth reading the product specification: Explore our product portfolio - nordicsemi.com .
In particular note section 4.
VDD = 1.9 - 3.6 V
VDD if input signals >3.6v (your case) = 2.7 - 3.3v
i.e. better regulation is required with 5v signals.