fix(search): dropdown dead on htmx-less pages; Alpine-side debounce; auto bundle stamps

The "top search bar doesn't work" report had TWO stacked causes, found
by reproducing with real keypress-by-keypress typing instead of
Playwright's fill() (which fires a single input event and masked both):

1. htmx.min.js was included PER PAGE. The header's live search is
   htmx-driven on every page, but five pages rendering @Header —
   series, admin, admin hash-conflicts, admin processing-issues,
   browse-detail — never loaded it: the input's hx-* attributes were
   inert (htmx-internal-data absent), so typing produced no request at
   all. The include now lives in the header partial itself (classic
   script, before the module bundle); the sixteen per-page copies on
   @Header pages are removed (double-processing guard). Non-header
   pages (login/register/setup/reader/index) keep their own.

2. htmx's delay: modifier on a PROGRAMMATICALLY dispatched custom event
   (htmx.trigger) loses the request entirely under rapid successive
   triggers — every re-fire canceled the pending timer and the last
   never issued, so fast typing (the normal kind) never opened the
   dropdown while one-shot fill() worked. The debounce moved into the
   Alpine component (client-local state, where it belongs); htmx now
   executes the bare `search` event immediately.

Also made bundle staleness structurally impossible: each bundle's
script stamp is a content hash computed at startup (templates/
bundles.go), so a rebuild that changes bundle bytes changes its cache
key with no manual ?v=N bump — the manual stamp was how the first
dropdown fix stayed invisible for a deploy. The reader bundle (never
stamped at all) is covered too. HTML pages additionally send
Cache-Control: no-cache (they are dynamic), so a stale page can no
longer reference a stale stamp; /api, /static and /uploads keep their
native caching, pinned by a middleware test.

e2e/search-scrubber.spec.ts

@@ -61,24 +61,40 @@ test.describe("Header search + audio scrubber (client wiring)", () => {
   });
 
   test("header search dropdown opens on typing (regression: tree-shaken module)", async () => {
-    await page.goto("/bookshelf");
-    await expect(page.locator("#header-search")).toBeVisible();
+    // Drive the header on TWO pages: the bundle is shared, but this
+    // catches any page-scoped wiring surprise.
+    for (const pagePath of ["/bookshelf", "/series"]) {
+      await page.goto(pagePath);
+      const input = page.locator("#header-search");
+      await expect(input).toBeVisible();
 
-    // The regression this pins: search.ts (which registers the
-    // headerSearch Alpine component) was tree-shaken from the bundle,
-    // so typing did nothing — no request, no dropdown. The component
-    // must be registered (x-data resolves) and the htmx swap must land.
-    await page.fill("#header-search", "a");
-    // Below the 2-char minimum: no results may appear.
-    await page.waitForTimeout(700);
-    await expect(page.locator("#search-results")).toBeHidden();
+      // The regression this pins: search.ts (which registers the
+      // headerSearch Alpine component) was tree-shaken from the bundle,
+      // so typing did nothing — no request, no dropdown. Type with REAL
+      // key events (not fill) and assert the request carries the query.
+      await input.click();
+      await input.pressSequentially("algo", { delay: 90 });
 
-    await page.fill("#header-search", "al");
-    const results = page.locator("#search-results");
-    await expect(results).toBeVisible({ timeout: 10_000 });
-    await expect(results.locator(".search-result-item").first()).toBeVisible({
-      timeout: 10_000,
-    });
+      const requestPromise = page.waitForRequest(
+        (req) =>
+          req.url().includes("/api/media-items/search") &&
+          req.url().includes("q=algo") &&
+          (req.headers()["hx-request"] === "true" || req.headers()["hx-request"] === "true"),
+        { timeout: 10_000 },
+      );
+      const req = await requestPromise;
+      expect(req.url()).toContain("layout=dropdown");
+
+      const results = page.locator("#search-results");
+      await expect(results).toBeVisible({ timeout: 10_000 });
+      await expect(results.locator(".search-result-item").first()).toBeVisible({
+        timeout: 10_000,
+      });
+
+      // Escape closes the dropdown (keyboard contract).
+      await page.keyboard.press("Escape");
+      await expect(results).toBeHidden();
+    }
   });
 
   test("audio scrubber: grabbing the handle does not teleport (plain and Shift)", async ({ request }) => {