Isomorphic SSR: server renders HTML body, client takes over with SX

Server now renders page content as HTML inside <div id="sx-root">,
visible immediately before JavaScript loads. The SX source is still
included in a <script data-mount="#sx-root"> tag for client hydration.

SSR pipeline: after aser produces the SX wire format, parse and
render-to-html it (~17ms for a 22KB page). Islands with reactive
state gracefully fall back to empty — client hydrates them.

Supporting changes:
- Load signals.sx into OCaml kernel (reactive primitives for island SSR)
- Add cek-call and context to kernel env (needed by signals/deref)
- Island-aware component accessors in sx_types.ml
- render-to-html handles Island values (renders as component with fallback)
- Fix 431 (Request Header Fields Too Large): replace SX-Components
  header (full component name list) with SX-Components-Hash (12 chars)
- CORS allow SX-Components-Hash header

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

shared/sx/helpers.py

@@ -521,8 +521,18 @@ def components_for_request(source: str = "",
     elif extra_names:
         needed = extra_names
 
-    loaded_raw = request.headers.get("SX-Components", "")
-    loaded = set(loaded_raw.split(",")) if loaded_raw else set()
+    # Check hash first (new): if client hash matches current, skip all defs.
+    # Fall back to legacy name list (SX-Components) for backward compat.
+    comp_hash_header = request.headers.get("SX-Components-Hash", "")
+    if comp_hash_header:
+        from .jinja_bridge import components_for_page
+        _, current_hash = components_for_page("", service=None)
+        if comp_hash_header == current_hash:
+            return ""  # client has everything
+        loaded = set()  # hash mismatch — send all needed
+    else:
+        loaded_raw = request.headers.get("SX-Components", "")
+        loaded = set(loaded_raw.split(",")) if loaded_raw else set()
 
     parts = []
     for key, val in _COMPONENT_ENV.items():