Move SX construction from Python to .sx defcomps (phases 0-4)

Eliminate Python s-expression string building across account, orders,
federation, and cart services. Visual rendering logic now lives entirely
in .sx defcomp components; Python files contain only data serialization,
header/layout wiring, and thin wrappers that call defcomps.

Phase 0: Shared DRY extraction — auth/orders header defcomps, format-decimal/
pluralize/escape/route-prefix primitives.
Phase 1: Account — dashboard, newsletters, login/device/check-email content.
Phase 2: Orders — order list, detail, filter, checkout return assembled defcomps.
Phase 3: Federation — social nav, post cards, timeline, search, actors,
notifications, compose, profile assembled defcomps.
Phase 4: Cart — overview, page cart items/calendar/tickets/summary, admin,
payments assembled defcomps; orders rendering reuses Phase 2 shared defcomps.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

account/sx/auth.sx

@@ -27,3 +27,25 @@
     (h1 :class "text-2xl font-bold mb-4" "Device authorized")
     (p :class "text-stone-600" "You can close this window and return to your terminal.")))
 
+;; Assembled auth page content — replaces Python _login_page_content etc.
+
+(defcomp ~account-login-content (&key error email)
+  (~auth-login-form
+    :error (when error (~auth-error-banner :error error))
+    :action (url-for "auth.start_login")
+    :csrf-token (csrf-token)
+    :email (or email "")))
+
+(defcomp ~account-device-content (&key error code)
+  (~account-device-form
+    :error (when error (~account-device-error :error error))
+    :action (url-for "auth.device_submit")
+    :csrf-token (csrf-token)
+    :code (or code "")))
+
+(defcomp ~account-check-email-content (&key email email-error)
+  (~auth-check-email
+    :email (escape (or email ""))
+    :error (when email-error
+             (~auth-check-email-error :error (escape email-error)))))
+