feat(docs): standalone docs site chrome + category/subcategory navigation

Docs pages no longer embed the app Header (whose hx-post login form silently
degraded to a native GET, leaking credentials into the URL — this page never
loaded htmx). New docs-owned topbar: search, theme picker, Open App; anonymous
visitors get a plain /login link. Optional-auth middleware (hand-rolled —
echojwt's ErrorHandler return ends the chain, producing empty 200s) populates
the user for signed-in visitors.

Navigation rebuilt from the docs directory tree: 6 sections, subcategory
groups, server-rendered expansion and active states. Search results are a
templ partial (/docs/search/partial); code highlighting is server-side chroma
(previously dead hljs CSS); prose is theme-aware via typography DEFAULT vars
(prose-invert painted unreadable text under light themes). /docs renders the
index directly; standalone 404 without the tailwind CDN.

Tests: navigation routing/expansion (internal/docs), render pins asserting no
login form/password field/app sidebar ever return on docs pages.
lint-rendering: exempt *.test.ts fixtures (jsdom DOM building); docs.ts
baseline 5 -> 1.

internal/router/docs.go

@@ -6,8 +6,17 @@ import (
 
 func registerDocumentationRoutes(cfg *Config) {
 	docsHandler := docs.NewHTTPHandler("docs")
-	cfg.Echo.GET("/docs", docsHandler.DocsHome)
-	cfg.Echo.GET("/docs/*", docsHandler.ShowDocumentation)
+
+	// Docs render for anonymous AND signed-in visitors (it's the pre-login
+	// surface for setup/troubleshooting), so the HTML routes use the optional
+	// auth middleware: handlers get a populated user when a valid token is
+	// present, nil otherwise. The JSON/partial endpoints are public.
+	docsAuth := createOptionalAuthMiddleware(cfg)
+	cfg.Echo.GET("/docs", docsHandler.DocsHome, docsAuth)
+	cfg.Echo.GET("/docs/*", docsHandler.ShowDocumentation, docsAuth)
+
+	// Server-rendered search results partial (swapped in by web/src/docs.ts).
+	cfg.Echo.GET("/docs/search/partial", docsHandler.SearchPartial)
 	cfg.Echo.GET("/docs/api/search", docsHandler.Search)
 	cfg.Echo.GET("/docs/search-index.json", docsHandler.ServeSearchIndex)
 }