Remove render_to_sx from public API: enforce sx_call for all service code

Replace ~250 render_to_sx calls across all services with sync sx_call,
converting many async functions to sync where no other awaits remained.
Make render_to_sx/render_to_sx_with_env private (_render_to_sx).
Add (post-header-ctx) IO primitive and shared post/post-admin defmacros.
Convert built-in post/post-admin layouts from Python to register_sx_layout
with .sx defcomps. Remove dead post_admin_mobile_nav_sx.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

federation/bp/identity/routes.py

@@ -30,7 +30,7 @@ async def _render_choose_username(*, actor=None, error="", username=""):
     """Render choose-username page — replaces sx_components helper."""
     from shared.browser.app.csrf import generate_csrf_token
     from shared.config import config
-    from shared.sx.helpers import render_to_sx
+    from shared.sx.helpers import sx_call
     from shared.sx.parser import SxExpr
     from shared.sx.page import get_template_context
     from sxc.pages.utils import _social_page
@@ -41,8 +41,8 @@ async def _render_choose_username(*, actor=None, error="", username=""):
     ap_domain = config().get("ap_domain", "rose-ash.com")
     check_url = url_for("identity.check_username")
 
-    error_sx = await render_to_sx("auth-error-banner", error=error) if error else ""
-    content = await render_to_sx(
+    error_sx = sx_call("auth-error-banner", error=error) if error else ""
+    content = sx_call(
         "federation-choose-username",
         domain=str(escape(ap_domain)),
         error=SxExpr(error_sx) if error_sx else None,