Remove render_to_sx from public API: enforce sx_call for all service code

Replace ~250 render_to_sx calls across all services with sync sx_call,
converting many async functions to sync where no other awaits remained.
Make render_to_sx/render_to_sx_with_env private (_render_to_sx).
Add (post-header-ctx) IO primitive and shared post/post-admin defmacros.
Convert built-in post/post-admin layouts from Python to register_sx_layout
with .sx defcomps. Remove dead post_admin_mobile_nav_sx.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

blog/bp/snippets/routes.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 from quart import Blueprint, request, g, abort
 
 from shared.browser.app.authz import require_login
-from shared.sx.helpers import sx_response, render_to_sx
+from shared.sx.helpers import sx_response, sx_call
 from models import Snippet
 
 
@@ -14,7 +14,7 @@ async def _render_snippets():
     """Render snippets list via service data + .sx defcomp."""
     from shared.services.registry import services
     data = await services.blog_page.snippets_data(g.s)
-    return await render_to_sx("blog-snippets-content", **data)
+    return sx_call("blog-snippets-content", **data)
 
 
 def register():