Add cross-domain SX navigation with OOB swap

Enable instant cross-subdomain navigation (blog → market, etc.) via
sx-get instead of full page reloads. The server prepends missing
component definitions to OOB responses so the client can render
components from other domains.

- sexp.js: send SX-Components header, add credentials for cross-origin
  fetches to .rose-ash.com/.localhost, process sexp scripts in response
  before OOB swap
- helpers.py: add components_for_request() to diff client/server
  component sets, update sexp_response() to prepend missing defs
- factory.py: add SX-Components to CORS allowed headers, add
  Access-Control-Allow-Methods
- fragments/routes.py: switch nav items from ~blog-nav-item-plain to
  ~blog-nav-item-link (sx-get enabled)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

blog/bp/fragments/routes.py

@@ -63,8 +63,8 @@ def register():
                             src=getattr(item, "feature_image", None),
                             label=getattr(item, "label", item.slug))
             item_sexps.append(sexp_call(
-                "blog-nav-item-plain",
-                href=href, selected=selected, nav_cls=nav_cls,
+                "blog-nav-item-link",
+                href=href, hx_get=href, selected=selected, nav_cls=nav_cls,
                 img=SexpExpr(img), label=getattr(item, "label", item.slug),
             ))
 
@@ -74,8 +74,8 @@ def register():
                               or "artdag" == app_name) else "false"
         img = sexp_call("blog-nav-item-image", src=None, label="art-dag")
         item_sexps.append(sexp_call(
-            "blog-nav-item-plain",
-            href=href, selected=selected, nav_cls=nav_cls,
+            "blog-nav-item-link",
+            href=href, hx_get=href, selected=selected, nav_cls=nav_cls,
             img=SexpExpr(img), label="art-dag",
         ))