fix(search): dropdown dead on htmx-less pages; Alpine-side debounce; auto bundle stamps

The "top search bar doesn't work" report had TWO stacked causes, found
by reproducing with real keypress-by-keypress typing instead of
Playwright's fill() (which fires a single input event and masked both):

1. htmx.min.js was included PER PAGE. The header's live search is
   htmx-driven on every page, but five pages rendering @Header —
   series, admin, admin hash-conflicts, admin processing-issues,
   browse-detail — never loaded it: the input's hx-* attributes were
   inert (htmx-internal-data absent), so typing produced no request at
   all. The include now lives in the header partial itself (classic
   script, before the module bundle); the sixteen per-page copies on
   @Header pages are removed (double-processing guard). Non-header
   pages (login/register/setup/reader/index) keep their own.

2. htmx's delay: modifier on a PROGRAMMATICALLY dispatched custom event
   (htmx.trigger) loses the request entirely under rapid successive
   triggers — every re-fire canceled the pending timer and the last
   never issued, so fast typing (the normal kind) never opened the
   dropdown while one-shot fill() worked. The debounce moved into the
   Alpine component (client-local state, where it belongs); htmx now
   executes the bare `search` event immediately.

Also made bundle staleness structurally impossible: each bundle's
script stamp is a content hash computed at startup (templates/
bundles.go), so a rebuild that changes bundle bytes changes its cache
key with no manual ?v=N bump — the manual stamp was how the first
dropdown fix stayed invisible for a deploy. The reader bundle (never
stamped at all) is covered too. HTML pages additionally send
Cache-Control: no-cache (they are dynamic), so a stale page can no
longer reference a stale stamp; /api, /static and /uploads keep their
native caching, pinned by a middleware test.

internal/middleware/security_headers.go

@@ -1,6 +1,8 @@
 package middleware
 
 import (
+	"strings"
+
 	"github.com/labstack/echo/v5"
 )
 
@@ -9,7 +11,14 @@ import (
 // the rendered component by security_headers_test.go.
 const ScriptHashThemeFlashGuard = "'sha256-JYIVpFyKdLUtWizMha0v69f6yHds+GbJRBWjvpuECBY='"
 
-// SecurityHeadersMiddleware adds security headers to all responses
+// SecurityHeadersMiddleware adds security headers to all responses.
+// It also forces HTML pages to revalidate (Cache-Control: no-cache):
+// SSR pages are dynamic, and heuristic browser caching of a PAGE let a
+// stale page reference a stale main.js stamp long after the bundle was
+// fixed — the "search dropdown still broken" report was exactly that.
+// /api, /static and /uploads keep their own (or absent) caching: the
+// stamped bundles are content-frozen by URL, media files are immutable
+// by path.
 func SecurityHeadersMiddleware() echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c *echo.Context) error {
@@ -39,6 +48,19 @@ func SecurityHeadersMiddleware() echo.MiddlewareFunc {
 			c.Response().Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
 			c.Response().Header().Set("Permissions-Policy", "geolocation=(), microphone=(), camera=()")
 
+			// Pages must always revalidate (see doc comment). The check
+			// runs BEFORE next(): once a templ handler writes the body,
+			// response headers are already on the wire.
+			switch p := c.Request().URL.Path; {
+			case strings.HasPrefix(p, "/api/"),
+				strings.HasPrefix(p, "/static/"),
+				strings.HasPrefix(p, "/uploads/"),
+				p == "/health":
+				// Not a page: keep native caching behavior.
+			default:
+				c.Response().Header().Set("Cache-Control", "no-cache")
+			}
+
 			return next(c)
 		}
 	}

internal/middleware/security_headers_test.go

@@ -4,12 +4,16 @@ import (
 	"context"
 	"crypto/sha256"
 	"encoding/base64"
+	"net/http"
+	"net/http/httptest"
 	"regexp"
 	"strings"
 	"testing"
 
 	"bookhoard/internal/middleware"
 	"bookhoard/templates"
+
+	"github.com/labstack/echo/v5"
 )
 
 // TestThemeFlashGuardHashMatchesCSP pins the CSP script hash to the theme
@@ -49,3 +53,38 @@ middleware.ScriptHashThemeFlashGuard and the CSP header string.`,
 		t.Error("script-src must not re-introduce 'unsafe-inline' alongside the hash")
 	}
 }
+
+// HTML pages must always revalidate (Cache-Control: no-cache): a
+// heuristically cached PAGE referenced a stale main.js stamp and kept
+// the old bundle running long after a fix deployed (the 2026-10-27
+// "search dropdown still broken" report). Static/API/media routes keep
+// their native caching — stamped bundles are content-frozen by URL.
+func TestHTMLPagesRevalidate(t *testing.T) {
+	mw := middleware.SecurityHeadersMiddleware()
+
+	render := func(path string) string {
+		e := echo.New()
+		req, _ := http.NewRequest("GET", path, nil)
+		rec := httptest.NewRecorder()
+		c := e.NewContext(req, rec)
+		handler := mw(func(c *echo.Context) error {
+			return c.HTML(http.StatusOK, "<html></html>")
+		})
+		if err := handler(c); err != nil {
+			t.Fatalf("handler error: %v", err)
+		}
+		return rec.Header().Get("Cache-Control")
+	}
+
+	if got := render("/bookshelf"); got != "no-cache" {
+		t.Errorf("/bookshelf: Cache-Control = %q, want no-cache", got)
+	}
+	if got := render("/series"); got != "no-cache" {
+		t.Errorf("/series: Cache-Control = %q, want no-cache", got)
+	}
+	for _, p := range []string{"/static/main.js", "/api/media-items", "/uploads/library-x/book.epub", "/health"} {
+		if got := render(p); got == "no-cache" {
+			t.Errorf("%s: must keep native caching, got no-cache", p)
+		}
+	}
+}