fix(search): dropdown dead on htmx-less pages; Alpine-side debounce; auto bundle stamps

The "top search bar doesn't work" report had TWO stacked causes, found
by reproducing with real keypress-by-keypress typing instead of
Playwright's fill() (which fires a single input event and masked both):

1. htmx.min.js was included PER PAGE. The header's live search is
   htmx-driven on every page, but five pages rendering @Header —
   series, admin, admin hash-conflicts, admin processing-issues,
   browse-detail — never loaded it: the input's hx-* attributes were
   inert (htmx-internal-data absent), so typing produced no request at
   all. The include now lives in the header partial itself (classic
   script, before the module bundle); the sixteen per-page copies on
   @Header pages are removed (double-processing guard). Non-header
   pages (login/register/setup/reader/index) keep their own.

2. htmx's delay: modifier on a PROGRAMMATICALLY dispatched custom event
   (htmx.trigger) loses the request entirely under rapid successive
   triggers — every re-fire canceled the pending timer and the last
   never issued, so fast typing (the normal kind) never opened the
   dropdown while one-shot fill() worked. The debounce moved into the
   Alpine component (client-local state, where it belongs); htmx now
   executes the bare `search` event immediately.

Also made bundle staleness structurally impossible: each bundle's
script stamp is a content hash computed at startup (templates/
bundles.go), so a rebuild that changes bundle bytes changes its cache
key with no manual ?v=N bump — the manual stamp was how the first
dropdown fix stayed invisible for a deploy. The reader bundle (never
stamped at all) is covered too. HTML pages additionally send
Cache-Control: no-cache (they are dynamic), so a stale page can no
longer reference a stale stamp; /api, /static and /uploads keep their
native caching, pinned by a middleware test.

templates/header.templ

@@ -4,6 +4,12 @@ templ Header(user User, currentPath string) {
 	<div
 		x-data="header"
 	>
+		<!-- htmx loads with the header (classic script, before the module
+		     bundle): the header's live search is htmx-driven on EVERY
+		     page, so the include lives HERE — not per-page. Pages that
+		     render @Header must not include htmx.min.js themselves
+		     (double processing). -->
+		<script src="/static/htmx.min.js"></script>
 		<!-- Mobile backdrop -->
 		<div
 			class="app-sidebar-backdrop lg:hidden"
@@ -246,7 +252,7 @@ templ Header(user User, currentPath string) {
 						@keydown.enter.prevent="openSelected()"
 						@keydown.escape="close()"
 						hx-get="/api/media-items/search?layout=dropdown"
-						hx-trigger="search delay:300ms"
+						hx-trigger="search"
 						hx-target="#search-results"
 						hx-swap="innerHTML"
 					/>
@@ -260,9 +266,10 @@ templ Header(user User, currentPath string) {
 				</div>
 			</div>
 		</header>
-		<!-- module bundle; ?v=<commit-ish stamp> busts stale intermediate
-		     builds across app restarts (browser caches are keyed by URL) -->
-		<script type="module" src="/static/main.js?v=8"></script>
+		<!-- module bundle; ?v=<content hash> busts stale intermediate
+		     builds across app restarts (browser caches are keyed by URL);
+		     the hash is computed at startup from the served file -->
+		<script type="module" src={ "/static/main.js?v=" + MainJSVersion() }></script>
 	</div>
 }