Refactor SX templates: shared components, Python migration, cleanup

- Extract shared components (empty-state, delete-btn, sentinel, crud-*,
  view-toggle, img-or-placeholder, avatar, sumup-settings-form, auth
  forms, order tables/detail/checkout)
- Migrate all Python sx_call() callers to use shared components directly
- Remove 55+ thin wrapper defcomps from domain .sx files
- Remove trivial passthrough wrappers (blog-header-label, market-card-text, etc)
- Unify duplicate auth flows (account + federation) into shared/sx/templates/auth.sx
- Unify duplicate order views (cart + orders) into shared/sx/templates/orders.sx
- Disable static file caching in dev (SEND_FILE_MAX_AGE_DEFAULT=0)
- Add SX response validation and debug headers

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

account/sx/auth.sx

@@ -1,23 +1,5 @@
-;; Auth page components (login, device, check email)
-
-(defcomp ~account-login-error (&key error)
-  (when error
-    (div :class "bg-red-50 border border-red-200 text-red-700 p-3 rounded mb-4"
-      error)))
-
-(defcomp ~account-login-form (&key error action csrf-token email)
-  (div :class "py-8 max-w-md mx-auto"
-    (h1 :class "text-2xl font-bold mb-6" "Sign in")
-    error
-    (form :method "post" :action action :class "space-y-4"
-      (input :type "hidden" :name "csrf_token" :value csrf-token)
-      (div
-        (label :for "email" :class "block text-sm font-medium mb-1" "Email address")
-        (input :type "email" :name "email" :id "email" :value email :required true :autofocus true
-          :class "w-full border border-stone-300 rounded px-3 py-2 focus:outline-none focus:ring-2 focus:ring-stone-500"))
-      (button :type "submit"
-        :class "w-full bg-stone-800 text-white py-2 px-4 rounded hover:bg-stone-700 transition"
-        "Send magic link"))))
+;; Auth page components (device auth — account-specific)
+;; Login and check-email components are shared: see shared/sx/templates/auth.sx
 
 (defcomp ~account-device-error (&key error)
   (when error
@@ -45,14 +27,3 @@
     (h1 :class "text-2xl font-bold mb-4" "Device authorized")
     (p :class "text-stone-600" "You can close this window and return to your terminal.")))
 
-(defcomp ~account-check-email-error (&key error)
-  (when error
-    (div :class "bg-yellow-50 border border-yellow-200 text-yellow-700 p-3 rounded mt-4"
-      error)))
-
-(defcomp ~account-check-email (&key email error)
-  (div :class "py-8 max-w-md mx-auto text-center"
-    (h1 :class "text-2xl font-bold mb-4" "Check your email")
-    (p :class "text-stone-600 mb-2" "We sent a sign-in link to " (strong email) ".")
-    (p :class "text-stone-500 text-sm" "Click the link in the email to sign in. The link expires in 15 minutes.")
-    error))

account/sx/dashboard.sx

@@ -41,8 +41,3 @@
           name)
         logout)
       labels)))
-
-;; Header child wrapper
-(defcomp ~account-header-child (&key inner)
-  (div :id "root-header-child" :class "flex flex-col w-full items-center"
-    inner))

account/sx/newsletters.sx

@@ -10,12 +10,6 @@
       :class cls :role "switch" :aria-checked checked
       (span :class knob-cls))))
 
-(defcomp ~account-newsletter-toggle-off (&key id url hdrs target)
-  (div :id id :class "flex items-center"
-    (button :sx-post url :sx-headers hdrs :sx-target target :sx-swap "outerHTML"
-      :class "relative inline-flex h-6 w-11 items-center rounded-full transition-colors focus:outline-none focus:ring-2 focus:ring-emerald-500 focus:ring-offset-2 bg-stone-300"
-      :role "switch" :aria-checked "false"
-      (span :class "inline-block h-4 w-4 rounded-full bg-white shadow transform transition-transform translate-x-1"))))
 
 (defcomp ~account-newsletter-item (&key name desc toggle)
   (div :class "flex items-center justify-between py-4 first:pt-0 last:pb-0"

account/sx/sx_components.py

@@ -137,10 +137,13 @@ def _newsletter_toggle_sx(un: Any, account_url_fn: Any, csrf_token: str) -> str:
 def _newsletter_toggle_off_sx(nid: int, toggle_url: str, csrf_token: str) -> str:
     """Render an unsubscribed newsletter toggle (no subscription record yet)."""
     return sx_call(
-        "account-newsletter-toggle-off",
+        "account-newsletter-toggle",
         id=f"nl-{nid}", url=toggle_url,
         hdrs=f'{{"X-CSRFToken": "{csrf_token}"}}',
         target=f"#nl-{nid}",
+        cls="relative inline-flex h-6 w-11 items-center rounded-full transition-colors focus:outline-none focus:ring-2 focus:ring-emerald-500 focus:ring-offset-2 bg-stone-300",
+        checked="false",
+        knob_cls="inline-block h-4 w-4 rounded-full bg-white shadow transform transition-transform translate-x-1",
     )
 
 
@@ -196,10 +199,10 @@ def _login_page_content(ctx: dict) -> str:
     email = ctx.get("email", "")
     action = url_for("auth.start_login")
 
-    error_sx = sx_call("account-login-error", error=error) if error else ""
+    error_sx = sx_call("auth-error-banner", error=error) if error else ""
 
     return sx_call(
-        "account-login-form",
+        "auth-login-form",
         error=SxExpr(error_sx) if error_sx else None,
         action=action,
         csrf_token=generate_csrf_token(), email=email,
@@ -347,11 +350,11 @@ def _check_email_content(email: str, email_error: str | None = None) -> str:
     from markupsafe import escape
 
     error_sx = sx_call(
-        "account-check-email-error", error=str(escape(email_error))
+        "auth-check-email-error", error=str(escape(email_error))
     ) if email_error else ""
 
     return sx_call(
-        "account-check-email",
+        "auth-check-email",
         email=str(escape(email)),
         error=SxExpr(error_sx) if error_sx else None,
     )