sx-http: fix AJAX fragment extraction + proper back button test

AJAX fragment: extract #main-panel with matching close tag (depth
tracking) instead of taking everything to end of file. Prevents
shell closing tags from breaking the DOM swap.

Back button test: verifies content actually changes — checks for
"Geography" and "Rendering Pipeline" after going back, not just
that body has >100 chars. Tests forward nav content change too.

7/7 navigation tests pass including back button content verification.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

hosts/ocaml/bin/sx_server.ml

@@ -2117,7 +2117,35 @@ let http_mode port =
                 with _ -> None in
                 match panel_start with
                 | Some start ->
-                  let fragment = String.sub html start (String.length html - start) in
+                  (* Find the tag name (section, div, etc.) *)
+                  let tag_end = ref (start + 1) in
+                  while !tag_end < String.length html && html.[!tag_end] <> ' ' && html.[!tag_end] <> '>' do
+                    tag_end := !tag_end + 1
+                  done;
+                  let tag = String.sub html (start + 1) (!tag_end - start - 1) in
+                  (* Find matching close tag by counting depth *)
+                  let open_tag = "<" ^ tag in
+                  let close_tag = "</" ^ tag ^ ">" in
+                  let depth = ref 1 in
+                  let pos = ref (!tag_end) in
+                  let found_end = ref (String.length html) in
+                  while !depth > 0 && !pos < String.length html - String.length close_tag do
+                    if String.sub html !pos (String.length close_tag) = close_tag then begin
+                      depth := !depth - 1;
+                      if !depth = 0 then
+                        found_end := !pos + String.length close_tag
+                      else
+                        pos := !pos + 1
+                    end else if !pos + String.length open_tag < String.length html
+                              && String.sub html !pos (String.length open_tag) = open_tag
+                              && (html.[!pos + String.length open_tag] = ' '
+                                  || html.[!pos + String.length open_tag] = '>') then begin
+                      depth := !depth + 1;
+                      pos := !pos + 1
+                    end else
+                      pos := !pos + 1
+                  done;
+                  let fragment = String.sub html start (!found_end - start) in
                   http_response ~content_type:"text/html; charset=utf-8" fragment
                 | None -> http_response html
               end else begin