Refactor SX templates: shared components, Python migration, cleanup

- Extract shared components (empty-state, delete-btn, sentinel, crud-*,
  view-toggle, img-or-placeholder, avatar, sumup-settings-form, auth
  forms, order tables/detail/checkout)
- Migrate all Python sx_call() callers to use shared components directly
- Remove 55+ thin wrapper defcomps from domain .sx files
- Remove trivial passthrough wrappers (blog-header-label, market-card-text, etc)
- Unify duplicate auth flows (account + federation) into shared/sx/templates/auth.sx
- Unify duplicate order views (cart + orders) into shared/sx/templates/orders.sx
- Disable static file caching in dev (SEND_FILE_MAX_AGE_DEFAULT=0)
- Add SX response validation and debug headers

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

federation/sx/sx_components.py

@@ -11,6 +11,7 @@ from typing import Any
 from markupsafe import escape
 
 from shared.sx.jinja_bridge import load_service_components
+from shared.sx.parser import serialize
 from shared.sx.helpers import (
     sx_call, SxExpr,
     root_header_sx, full_page_sx, header_child_sx,
@@ -45,12 +46,8 @@ def _social_nav_sx(actor: Any) -> str:
     for endpoint, label in links:
         href = url_for(endpoint)
         bold = " font-bold" if request.path == href else ""
-        parts.append(sx_call(
-            "federation-nav-link",
-            href=href,
-            cls=f"px-2 py-1 rounded hover:bg-stone-200{bold}",
-            label=label,
-        ))
+        cls = f"px-2 py-1 rounded hover:bg-stone-200{bold}"
+        parts.append(f'(a :href {serialize(href)} :class {serialize(cls)} {serialize(label)})')
 
     # Notifications with live badge
     notif_url = url_for("social.notifications")
@@ -65,12 +62,7 @@ def _social_nav_sx(actor: Any) -> str:
 
     # Profile link
     profile_url = url_for("activitypub.actor_profile", username=actor.preferred_username)
-    parts.append(sx_call(
-        "federation-nav-link",
-        href=profile_url,
-        cls="px-2 py-1 rounded hover:bg-stone-200",
-        label=f"@{actor.preferred_username}",
-    ))
+    parts.append(f'(a :href {serialize(profile_url)} :class "px-2 py-1 rounded hover:bg-stone-200" {serialize("@" + actor.preferred_username)})')
 
     items_sx = "(<> " + " ".join(parts) + ")"
     return sx_call("federation-nav-bar", items=SxExpr(items_sx))
@@ -171,26 +163,23 @@ def _post_card_sx(item: Any, actor: Any) -> str:
         "federation-boost-label", name=str(escape(boosted_by)),
     ) if boosted_by else ""
 
-    if actor_icon:
-        avatar = sx_call("federation-avatar-img", src=actor_icon, cls="w-10 h-10 rounded-full")
-    else:
-        initial = actor_name[0].upper() if actor_name else "?"
-        avatar = sx_call(
-            "federation-avatar-placeholder",
-            cls="w-10 h-10 rounded-full bg-stone-300 flex items-center justify-center text-stone-600 font-bold text-sm",
-            initial=initial,
-        )
+    initial = actor_name[0].upper() if (not actor_icon and actor_name) else "?"
+    avatar = sx_call(
+        "avatar", src=actor_icon or None,
+        cls="w-10 h-10 rounded-full" if actor_icon else "w-10 h-10 rounded-full bg-stone-300 flex items-center justify-center text-stone-600 font-bold text-sm",
+        initial=None if actor_icon else initial,
+    )
 
     domain_str = f"@{escape(actor_domain)}" if actor_domain else ""
     time_str = published.strftime("%b %d, %H:%M") if published else ""
 
     if summary:
         content_sx = sx_call(
-            "federation-content-cw",
-            summary=str(escape(summary)), content=content,
+            "federation-content",
+            content=content, summary=str(escape(summary)),
         )
     else:
-        content_sx = sx_call("federation-content-plain", content=content)
+        content_sx = sx_call("federation-content", content=content)
 
     original_sx = ""
     if url and post_type == "remote":
@@ -200,11 +189,7 @@ def _post_card_sx(item: Any, actor: Any) -> str:
     if actor:
         oid = getattr(item, "object_id", "") or ""
         safe_id = oid.replace("/", "_").replace(":", "_")
-        interactions_sx = sx_call(
-            "federation-interactions-wrap",
-            id=f"interactions-{safe_id}",
-            buttons=SxExpr(_interaction_buttons_sx(item, actor)),
-        )
+        interactions_sx = f'(div :id {serialize(f"interactions-{safe_id}")} {_interaction_buttons_sx(item, actor)})'
 
     return sx_call(
         "federation-post-card",
@@ -263,15 +248,12 @@ def _actor_card_sx(a: Any, actor: Any, followed_urls: set,
 
     safe_id = actor_url.replace("/", "_").replace(":", "_")
 
-    if icon_url:
-        avatar = sx_call("federation-actor-avatar-img", src=icon_url, cls="w-12 h-12 rounded-full")
-    else:
-        initial = (display_name or username)[0].upper() if (display_name or username) else "?"
-        avatar = sx_call(
-            "federation-actor-avatar-placeholder",
-            cls="w-12 h-12 rounded-full bg-stone-300 flex items-center justify-center text-stone-600 font-bold",
-            initial=initial,
-        )
+    initial = (display_name or username)[0].upper() if (not icon_url and (display_name or username)) else "?"
+    avatar = sx_call(
+        "avatar", src=icon_url or None,
+        cls="w-12 h-12 rounded-full" if icon_url else "w-12 h-12 rounded-full bg-stone-300 flex items-center justify-center text-stone-600 font-bold",
+        initial=None if icon_url else initial,
+    )
 
     # Name link
     if (list_type in ("following", "search")) and aid:
@@ -359,15 +341,12 @@ def _notification_sx(notif: Any) -> str:
 
     border = " border-l-4 border-l-stone-400" if not read else ""
 
-    if from_icon:
-        avatar = sx_call("federation-avatar-img", src=from_icon, cls="w-8 h-8 rounded-full")
-    else:
-        initial = from_name[0].upper() if from_name else "?"
-        avatar = sx_call(
-            "federation-avatar-placeholder",
-            cls="w-8 h-8 rounded-full bg-stone-300 flex items-center justify-center text-stone-600 font-bold text-xs",
-            initial=initial,
-        )
+    initial = from_name[0].upper() if (not from_icon and from_name) else "?"
+    avatar = sx_call(
+        "avatar", src=from_icon or None,
+        cls="w-8 h-8 rounded-full" if from_icon else "w-8 h-8 rounded-full bg-stone-300 flex items-center justify-center text-stone-600 font-bold text-xs",
+        initial=None if from_icon else initial,
+    )
 
     domain_str = f"@{escape(from_domain)}" if from_domain else ""
 
@@ -423,12 +402,12 @@ async def render_login_page(ctx: dict) -> str:
     action = url_for("auth.start_login")
     csrf = generate_csrf_token()
 
-    error_sx = sx_call("federation-error-banner", error=error) if error else ""
+    error_sx = sx_call("auth-error-banner", error=error) if error else ""
 
     content = sx_call(
-        "federation-login-form",
+        "auth-login-form",
         error=SxExpr(error_sx) if error_sx else None,
-        action=action, csrf=csrf,
+        action=action, csrf_token=csrf,
         email=str(escape(email)),
     )
 
@@ -442,11 +421,11 @@ async def render_check_email_page(ctx: dict) -> str:
     email_error = ctx.get("email_error")
 
     error_sx = sx_call(
-        "federation-check-email-error", error=str(escape(email_error)),
+        "auth-check-email-error", error=str(escape(email_error)),
     ) if email_error else ""
 
     content = sx_call(
-        "federation-check-email",
+        "auth-check-email",
         email=str(escape(email)),
         error=SxExpr(error_sx) if error_sx else None,
     )
@@ -622,15 +601,12 @@ async def render_actor_timeline_page(ctx: dict, remote_actor: Any, items: list,
     summary = getattr(remote_actor, "summary", None)
     actor_url = getattr(remote_actor, "actor_url", "")
 
-    if icon_url:
-        avatar = sx_call("federation-avatar-img", src=icon_url, cls="w-16 h-16 rounded-full")
-    else:
-        initial = display_name[0].upper() if display_name else "?"
-        avatar = sx_call(
-            "federation-avatar-placeholder",
-            cls="w-16 h-16 rounded-full bg-stone-300 flex items-center justify-center text-stone-600 font-bold text-xl",
-            initial=initial,
-        )
+    initial = display_name[0].upper() if (not icon_url and display_name) else "?"
+    avatar = sx_call(
+        "avatar", src=icon_url or None,
+        cls="w-16 h-16 rounded-full" if icon_url else "w-16 h-16 rounded-full bg-stone-300 flex items-center justify-center text-stone-600 font-bold text-xl",
+        initial=None if icon_url else initial,
+    )
 
     summary_sx = sx_call("federation-profile-summary", summary=summary) if summary else ""
 
@@ -687,7 +663,8 @@ async def render_notifications_page(ctx: dict, notifications: list,
                                      actor: Any) -> str:
     """Full page: notifications."""
     if not notifications:
-        notif_sx = sx_call("federation-notifications-empty")
+        notif_sx = sx_call("empty-state", message="No notifications yet.",
+                           cls="text-stone-500")
     else:
         items_sx = "(<> " + " ".join(_notification_sx(n) for n in notifications) + ")"
         notif_sx = sx_call(
@@ -717,7 +694,7 @@ async def render_choose_username_page(ctx: dict) -> str:
     check_url = url_for("identity.check_username")
     actor = ctx.get("actor")
 
-    error_sx = sx_call("federation-error-banner", error=error) if error else ""
+    error_sx = sx_call("auth-error-banner", error=error) if error else ""
 
     content = sx_call(
         "federation-choose-username",