Remove render_to_sx from public API: enforce sx_call for all service code

Replace ~250 render_to_sx calls across all services with sync sx_call,
converting many async functions to sync where no other awaits remained.
Make render_to_sx/render_to_sx_with_env private (_render_to_sx).
Add (post-header-ctx) IO primitive and shared post/post-admin defmacros.
Convert built-in post/post-admin layouts from Python to register_sx_layout
with .sx defcomps. Remove dead post_admin_mobile_nav_sx.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

orders/bp/order/routes.py

@@ -70,16 +70,16 @@ def register() -> Blueprint:
 
         if not hosted_url:
             from shared.sx.page import get_template_context
-            from shared.sx.helpers import render_to_sx, root_header_sx, header_child_sx, full_page_sx, call_url
+            from shared.sx.helpers import sx_call, root_header_sx, header_child_sx, full_page_sx, call_url
             from shared.sx.parser import SxExpr
             from shared.infrastructure.urls import cart_url
             tctx = await get_template_context()
             account_url = call_url(tctx, "account_url", "")
-            auth_hdr = await render_to_sx("auth-header-row", account_url=account_url)
+            auth_hdr = sx_call("auth-header-row", account_url=account_url)
             hdr = "(<> " + await root_header_sx(tctx) + " " + await header_child_sx(auth_hdr) + ")"
-            filt = await render_to_sx("checkout-error-header")
-            order_sx = await render_to_sx("checkout-error-order-id", oid=f"#{order.id}")
-            content = await render_to_sx(
+            filt = sx_call("checkout-error-header")
+            order_sx = sx_call("checkout-error-order-id", oid=f"#{order.id}")
+            content = sx_call(
                 "checkout-error-content",
                 msg="No hosted checkout URL returned from SumUp when trying to reopen payment.",
                 order=SxExpr(order_sx),