Replace JSON sx-headers with SX dict expressions, fix blog like component

sx-headers attributes now use native SX dict format {:key val} instead of
JSON strings. Eliminates manual JSON string construction in both .sx files
and Python callers.

- sx.js: parse sx-headers/sx-vals as SX dict ({: prefix) with JSON fallback,
  add _serializeDict for dict→attribute serialization, fix verbInfo scope in
  _doFetch error handler
- html.py: serialize dict attribute values via SX serialize() not str()
- All .sx files: {:X-CSRFToken csrf} replaces (str "{\"X-CSRFToken\": ...}")
- All Python callers: {"X-CSRFToken": csrf} dict replaces f-string JSON
- Blog like: extract ~blog-like-toggle, fix POST returning wrong component,
  fix emoji escapes in .sx (parser has no \U support), fix card :hx-headers
  keyword mismatch, wrap sx_content in SxExpr for evaluation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

events/sxc/pages/slots.py

@@ -263,7 +263,7 @@ def render_slots_table(slots, calendar) -> str:
                                 time_str=f"{time_start} - {time_end}",
                                 cost_str=cost_str, action_btn=action_btn,
                                 del_url=del_url,
-                                csrf_hdr=f'{{"X-CSRFToken": "{csrf}"}}')
+                                csrf_hdr={"X-CSRFToken": csrf})
     else:
         rows_html = sx_call("events-slots-empty-row")
 
@@ -343,7 +343,7 @@ def render_slot_add_form(calendar) -> str:
 
     post_url = url_for("calendar.slots.post", calendar_slug=cal_slug)
     cancel_url = url_for("calendar.slots.add_button", calendar_slug=cal_slug)
-    csrf_hdr = f'{{"X-CSRFToken": "{csrf}"}}'
+    csrf_hdr = {"X-CSRFToken": csrf}
 
     # Days checkboxes (all unchecked for add)
     day_keys = [("mon", "Mon"), ("tue", "Tue"), ("wed", "Wed"), ("thu", "Thu"),