fix(search): dropdown dead on htmx-less pages; Alpine-side debounce; auto bundle stamps

The "top search bar doesn't work" report had TWO stacked causes, found
by reproducing with real keypress-by-keypress typing instead of
Playwright's fill() (which fires a single input event and masked both):

1. htmx.min.js was included PER PAGE. The header's live search is
   htmx-driven on every page, but five pages rendering @Header —
   series, admin, admin hash-conflicts, admin processing-issues,
   browse-detail — never loaded it: the input's hx-* attributes were
   inert (htmx-internal-data absent), so typing produced no request at
   all. The include now lives in the header partial itself (classic
   script, before the module bundle); the sixteen per-page copies on
   @Header pages are removed (double-processing guard). Non-header
   pages (login/register/setup/reader/index) keep their own.

2. htmx's delay: modifier on a PROGRAMMATICALLY dispatched custom event
   (htmx.trigger) loses the request entirely under rapid successive
   triggers — every re-fire canceled the pending timer and the last
   never issued, so fast typing (the normal kind) never opened the
   dropdown while one-shot fill() worked. The debounce moved into the
   Alpine component (client-local state, where it belongs); htmx now
   executes the bare `search` event immediately.

Also made bundle staleness structurally impossible: each bundle's
script stamp is a content hash computed at startup (templates/
bundles.go), so a rebuild that changes bundle bytes changes its cache
key with no manual ?v=N bump — the manual stamp was how the first
dropdown fix stayed invisible for a deploy. The reader bundle (never
stamped at all) is covered too. HTML pages additionally send
Cache-Control: no-cache (they are dynamic), so a stale page can no
longer reference a stale stamp; /api, /static and /uploads keep their
native caching, pinned by a middleware test.

internal/middleware/security_headers_test.go

@@ -4,12 +4,16 @@ import (
 	"context"
 	"crypto/sha256"
 	"encoding/base64"
+	"net/http"
+	"net/http/httptest"
 	"regexp"
 	"strings"
 	"testing"
 
 	"bookhoard/internal/middleware"
 	"bookhoard/templates"
+
+	"github.com/labstack/echo/v5"
 )
 
 // TestThemeFlashGuardHashMatchesCSP pins the CSP script hash to the theme
@@ -49,3 +53,38 @@ middleware.ScriptHashThemeFlashGuard and the CSP header string.`,
 		t.Error("script-src must not re-introduce 'unsafe-inline' alongside the hash")
 	}
 }
+
+// HTML pages must always revalidate (Cache-Control: no-cache): a
+// heuristically cached PAGE referenced a stale main.js stamp and kept
+// the old bundle running long after a fix deployed (the 2026-10-27
+// "search dropdown still broken" report). Static/API/media routes keep
+// their native caching — stamped bundles are content-frozen by URL.
+func TestHTMLPagesRevalidate(t *testing.T) {
+	mw := middleware.SecurityHeadersMiddleware()
+
+	render := func(path string) string {
+		e := echo.New()
+		req, _ := http.NewRequest("GET", path, nil)
+		rec := httptest.NewRecorder()
+		c := e.NewContext(req, rec)
+		handler := mw(func(c *echo.Context) error {
+			return c.HTML(http.StatusOK, "<html></html>")
+		})
+		if err := handler(c); err != nil {
+			t.Fatalf("handler error: %v", err)
+		}
+		return rec.Header().Get("Cache-Control")
+	}
+
+	if got := render("/bookshelf"); got != "no-cache" {
+		t.Errorf("/bookshelf: Cache-Control = %q, want no-cache", got)
+	}
+	if got := render("/series"); got != "no-cache" {
+		t.Errorf("/series: Cache-Control = %q, want no-cache", got)
+	}
+	for _, p := range []string{"/static/main.js", "/api/media-items", "/uploads/library-x/book.epub", "/health"} {
+		if got := render(p); got == "no-cache" {
+			t.Errorf("%s: must keep native caching, got no-cache", p)
+		}
+	}
+}