fix(web): profile save silently died under htmx 2 — invalid-JSON hx-headers

Reproduced on the emulator via CDP: clicking Save Changes fired the
submit event, something preventDefault-ed it, and htmx aborted while
parsing hx-headers — 'Bearer ' + localStorage.getItem('token') is a JS
expression, and htmx 2 requires valid JSON (or a js: prefix) there.
The PUT never left the browser: zero htmx lifecycle events, no console
error, no toast. My earlier HX-Refresh fix was correct but unreachable
— the request died before it could ever be answered.

The header was htmx-1.x legacy and redundant: the browser already sends
the token cookie, which the auth middleware accepts. Removed hx-headers
from the profile form and both password-reset buttons.

Verified end-to-end in the emulator browser via CDP: Edit → change
timezone → Save → PUT 200, HX-Refresh reload, DB updated. The tab
reload mid-probe is the fix working.

templates/profile_form.templ

@@ -5,7 +5,6 @@ templ ProfileForm(user User, actionURL string, requireCurrentPassword bool, show
 		hx-put={ actionURL }
 		hx-target="#profile-result"
 		hx-swap="innerHTML"
-		hx-headers='{"Authorization": "Bearer " + localStorage.getItem("token")}'
 		class="space-y-8"
 	>
 		<div>
@@ -150,7 +149,6 @@ templ ProfileForm(user User, actionURL string, requireCurrentPassword bool, show
 					<button
 						type="button"
 						hx-put="/api/auth/password"
-						hx-headers='{"Authorization": "Bearer " + localStorage.getItem("token")}'
 						hx-target="#password-result"
 						hx-swap="innerHTML"
 						hx-include="closest form"
@@ -187,7 +185,6 @@ templ ProfileForm(user User, actionURL string, requireCurrentPassword bool, show
 					<button
 						type="button"
 						hx-put={ "/api/auth/password/" + user.ID }
-						hx-headers='{"Authorization": "Bearer " + localStorage.getItem("token")}'
 						hx-target="#password-result"
 						hx-swap="innerHTML"
 						hx-include="closest form"