fix(search): dropdown dead on htmx-less pages; Alpine-side debounce; auto bundle stamps

The "top search bar doesn't work" report had TWO stacked causes, found
by reproducing with real keypress-by-keypress typing instead of
Playwright's fill() (which fires a single input event and masked both):

1. htmx.min.js was included PER PAGE. The header's live search is
   htmx-driven on every page, but five pages rendering @Header —
   series, admin, admin hash-conflicts, admin processing-issues,
   browse-detail — never loaded it: the input's hx-* attributes were
   inert (htmx-internal-data absent), so typing produced no request at
   all. The include now lives in the header partial itself (classic
   script, before the module bundle); the sixteen per-page copies on
   @Header pages are removed (double-processing guard). Non-header
   pages (login/register/setup/reader/index) keep their own.

2. htmx's delay: modifier on a PROGRAMMATICALLY dispatched custom event
   (htmx.trigger) loses the request entirely under rapid successive
   triggers — every re-fire canceled the pending timer and the last
   never issued, so fast typing (the normal kind) never opened the
   dropdown while one-shot fill() worked. The debounce moved into the
   Alpine component (client-local state, where it belongs); htmx now
   executes the bare `search` event immediately.

Also made bundle staleness structurally impossible: each bundle's
script stamp is a content hash computed at startup (templates/
bundles.go), so a rebuild that changes bundle bytes changes its cache
key with no manual ?v=N bump — the manual stamp was how the first
dropdown fix stayed invisible for a deploy. The reader bundle (never
stamped at all) is covered too. HTML pages additionally send
Cache-Control: no-cache (they are dynamic), so a stale page can no
longer reference a stale stamp; /api, /static and /uploads keep their
native caching, pinned by a middleware test.

internal/middleware/security_headers.go

@@ -1,6 +1,8 @@
 package middleware
 
 import (
+	"strings"
+
 	"github.com/labstack/echo/v5"
 )
 
@@ -9,7 +11,14 @@ import (
 // the rendered component by security_headers_test.go.
 const ScriptHashThemeFlashGuard = "'sha256-JYIVpFyKdLUtWizMha0v69f6yHds+GbJRBWjvpuECBY='"
 
-// SecurityHeadersMiddleware adds security headers to all responses
+// SecurityHeadersMiddleware adds security headers to all responses.
+// It also forces HTML pages to revalidate (Cache-Control: no-cache):
+// SSR pages are dynamic, and heuristic browser caching of a PAGE let a
+// stale page reference a stale main.js stamp long after the bundle was
+// fixed — the "search dropdown still broken" report was exactly that.
+// /api, /static and /uploads keep their own (or absent) caching: the
+// stamped bundles are content-frozen by URL, media files are immutable
+// by path.
 func SecurityHeadersMiddleware() echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c *echo.Context) error {
@@ -39,6 +48,19 @@ func SecurityHeadersMiddleware() echo.MiddlewareFunc {
 			c.Response().Header().Set("Referrer-Policy", "strict-origin-when-cross-origin")
 			c.Response().Header().Set("Permissions-Policy", "geolocation=(), microphone=(), camera=()")
 
+			// Pages must always revalidate (see doc comment). The check
+			// runs BEFORE next(): once a templ handler writes the body,
+			// response headers are already on the wire.
+			switch p := c.Request().URL.Path; {
+			case strings.HasPrefix(p, "/api/"),
+				strings.HasPrefix(p, "/static/"),
+				strings.HasPrefix(p, "/uploads/"),
+				p == "/health":
+				// Not a page: keep native caching behavior.
+			default:
+				c.Response().Header().Set("Cache-Control", "no-cache")
+			}
+
 			return next(c)
 		}
 	}