Add OOB header swaps for sx docs navigation + enable OAuth + fragments

- OOB nav updates: AJAX navigation now swaps both menu bar levels
  (main nav highlighting + sub-nav with current page) using the same
  oob_header_sx/oob_page_sx pattern as blog/market/events
- Enable OAuth for sx and test apps (removed from _NO_OAUTH, added sx
  to ALLOWED_CLIENTS, added app_urls for sx/test/orders)
- Fetch real cross-service fragments (cart-mini, auth-menu, nav-tree)
  instead of hardcoding empty values
- Add :selected param to ~menu-row-sx for white text current-page label
- Fix duplicate element IDs: use menu-row-sx child_id/child mechanism
  instead of manual header_child_sx wrappers
- Fix home page copy: "Server-rendered DOM over the wire (no HTML)"

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

sx/sxc/home.sx

@@ -1,6 +1,6 @@
 ;; SX docs — home page components
 
-(defcomp ~sx-hero ()
+(defcomp ~sx-hero (&key &rest children)
   (div :class "max-w-4xl mx-auto px-6 py-16 text-center"
     (h1 :class "text-5xl font-bold text-stone-900 mb-4"
       (span :class "text-violet-600" "sx"))
@@ -10,9 +10,7 @@
       "A hypermedia-driven UI engine that combines htmx's server-first philosophy "
       "with React's component model. All rendered via s-expressions over the wire.")
     (div :class "bg-stone-50 border border-stone-200 rounded-lg p-6 text-left font-mono text-sm overflow-x-auto"
-      (pre
-        (code :class "language-lisp"
-          "(defcomp ~greeting (&key name)\n  (div :class \"p-4 rounded bg-violet-50\"\n    (h2 :class \"text-lg font-bold\"\n      (str \"Hello, \" name \"!\"))\n    (button\n      :sx-get \"/api/greet\"\n      :sx-target \"closest div\"\n      :sx-swap \"outerHTML\"\n      :class \"mt-2 px-4 py-2 bg-violet-600 text-white rounded\"\n      \"Refresh\")))")))))
+      (pre :class "leading-relaxed" children))))
 
 (defcomp ~sx-philosophy ()
   (div :class "max-w-4xl mx-auto px-6 py-12"
@@ -21,7 +19,7 @@
       (div :class "space-y-4"
         (h3 :class "text-xl font-semibold text-violet-700" "From htmx")
         (ul :class "space-y-2 text-stone-600"
-          (li "Server-rendered HTML over the wire")
+          (li "Server-rendered DOM over the wire (no HTML)")
           (li "Hypermedia attributes on any element (sx-get, sx-post, ...)")
           (li "Target/swap model for partial page updates")
           (li "No client-side routing, no virtual DOM")