feat(docs): standalone docs site chrome + category/subcategory navigation

Docs pages no longer embed the app Header (whose hx-post login form silently
degraded to a native GET, leaking credentials into the URL — this page never
loaded htmx). New docs-owned topbar: search, theme picker, Open App; anonymous
visitors get a plain /login link. Optional-auth middleware (hand-rolled —
echojwt's ErrorHandler return ends the chain, producing empty 200s) populates
the user for signed-in visitors.

Navigation rebuilt from the docs directory tree: 6 sections, subcategory
groups, server-rendered expansion and active states. Search results are a
templ partial (/docs/search/partial); code highlighting is server-side chroma
(previously dead hljs CSS); prose is theme-aware via typography DEFAULT vars
(prose-invert painted unreadable text under light themes). /docs renders the
index directly; standalone 404 without the tailwind CDN.

Tests: navigation routing/expansion (internal/docs), render pins asserting no
login form/password field/app sidebar ever return on docs pages.
lint-rendering: exempt *.test.ts fixtures (jsdom DOM building); docs.ts
baseline 5 -> 1.

internal/router/frontend.go

@@ -706,9 +706,9 @@ func registerFrontendRoutes(cfg *Config) {
 		books, libRes, isSmart, errCode := cfg.loadCollectionBooks(c, user, collection, collectionID)
 		if errCode != "" {
 			msg := map[string]string{
-				"books_load_error":  "Error loading books",
+				"books_load_error":   "Error loading books",
 				"invalid_library_id": "Invalid library ID",
-				"invalid_id":        "Invalid collection ID",
+				"invalid_id":         "Invalid collection ID",
 			}[errCode]
 			return renderErrorPage(c, msg, errCode)
 		}