Refactor SX templates: shared components, Python migration, cleanup

- Extract shared components (empty-state, delete-btn, sentinel, crud-*,
  view-toggle, img-or-placeholder, avatar, sumup-settings-form, auth
  forms, order tables/detail/checkout)
- Migrate all Python sx_call() callers to use shared components directly
- Remove 55+ thin wrapper defcomps from domain .sx files
- Remove trivial passthrough wrappers (blog-header-label, market-card-text, etc)
- Unify duplicate auth flows (account + federation) into shared/sx/templates/auth.sx
- Unify duplicate order views (cart + orders) into shared/sx/templates/orders.sx
- Disable static file caching in dev (SEND_FILE_MAX_AGE_DEFAULT=0)
- Add SX response validation and debug headers

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

account/sx/sx_components.py

@@ -137,10 +137,13 @@ def _newsletter_toggle_sx(un: Any, account_url_fn: Any, csrf_token: str) -> str:
 def _newsletter_toggle_off_sx(nid: int, toggle_url: str, csrf_token: str) -> str:
     """Render an unsubscribed newsletter toggle (no subscription record yet)."""
     return sx_call(
-        "account-newsletter-toggle-off",
+        "account-newsletter-toggle",
         id=f"nl-{nid}", url=toggle_url,
         hdrs=f'{{"X-CSRFToken": "{csrf_token}"}}',
         target=f"#nl-{nid}",
+        cls="relative inline-flex h-6 w-11 items-center rounded-full transition-colors focus:outline-none focus:ring-2 focus:ring-emerald-500 focus:ring-offset-2 bg-stone-300",
+        checked="false",
+        knob_cls="inline-block h-4 w-4 rounded-full bg-white shadow transform transition-transform translate-x-1",
     )
 
 
@@ -196,10 +199,10 @@ def _login_page_content(ctx: dict) -> str:
     email = ctx.get("email", "")
     action = url_for("auth.start_login")
 
-    error_sx = sx_call("account-login-error", error=error) if error else ""
+    error_sx = sx_call("auth-error-banner", error=error) if error else ""
 
     return sx_call(
-        "account-login-form",
+        "auth-login-form",
         error=SxExpr(error_sx) if error_sx else None,
         action=action,
         csrf_token=generate_csrf_token(), email=email,
@@ -347,11 +350,11 @@ def _check_email_content(email: str, email_error: str | None = None) -> str:
     from markupsafe import escape
 
     error_sx = sx_call(
-        "account-check-email-error", error=str(escape(email_error))
+        "auth-check-email-error", error=str(escape(email_error))
     ) if email_error else ""
 
     return sx_call(
-        "account-check-email",
+        "auth-check-email",
         email=str(escape(email)),
         error=SxExpr(error_sx) if error_sx else None,
     )