fix(search): dropdown dead on htmx-less pages; Alpine-side debounce; auto bundle stamps

The "top search bar doesn't work" report had TWO stacked causes, found
by reproducing with real keypress-by-keypress typing instead of
Playwright's fill() (which fires a single input event and masked both):

1. htmx.min.js was included PER PAGE. The header's live search is
   htmx-driven on every page, but five pages rendering @Header —
   series, admin, admin hash-conflicts, admin processing-issues,
   browse-detail — never loaded it: the input's hx-* attributes were
   inert (htmx-internal-data absent), so typing produced no request at
   all. The include now lives in the header partial itself (classic
   script, before the module bundle); the sixteen per-page copies on
   @Header pages are removed (double-processing guard). Non-header
   pages (login/register/setup/reader/index) keep their own.

2. htmx's delay: modifier on a PROGRAMMATICALLY dispatched custom event
   (htmx.trigger) loses the request entirely under rapid successive
   triggers — every re-fire canceled the pending timer and the last
   never issued, so fast typing (the normal kind) never opened the
   dropdown while one-shot fill() worked. The debounce moved into the
   Alpine component (client-local state, where it belongs); htmx now
   executes the bare `search` event immediately.

Also made bundle staleness structurally impossible: each bundle's
script stamp is a content hash computed at startup (templates/
bundles.go), so a rebuild that changes bundle bytes changes its cache
key with no manual ?v=N bump — the manual stamp was how the first
dropdown fix stayed invisible for a deploy. The reader bundle (never
stamped at all) is covered too. HTML pages additionally send
Cache-Control: no-cache (they are dynamic), so a stale page can no
longer reference a stale stamp; /api, /static and /uploads keep their
native caching, pinned by a middleware test.

internal/router/router.go

@@ -11,9 +11,13 @@ import (
 	"bookhoard/templates"
 	"bytes"
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"log"
 	"mime"
 	"net/http"
+	"os"
+	"path/filepath"
 	"strconv"
 	"strings"
 	"time"
@@ -349,6 +353,19 @@ func RegisterRoutes(cfg *Config) *handlers.Handler {
 		}
 	})
 
+	// Bundle stamps: ?v=<content-hash> per bundle, computed at startup —
+	// a rebuild that changes a bundle's bytes changes its cache key with
+	// no manual stamp bump (see templates/bundles.go; the manual ?v=N
+	// stamp is how a fixed search dropdown stayed broken for a deploy).
+	for _, bundle := range []string{"main.js", "reader.js"} {
+		if data, err := os.ReadFile(filepath.Join("web/static", bundle)); err == nil {
+			sum := sha256.Sum256(data)
+			templates.SetBundleVersion(bundle, hex.EncodeToString(sum[:])[:8])
+		} else {
+			log.Printf("bundle %s not found for stamping: %v", bundle, err)
+		}
+	}
+
 	e.Static("/static", "web/static")
 
 	// Catch-all 404 handler - must be last