feat: initial shared library extraction

Contains shared infrastructure for all coop services:
- shared/ (factory, urls, user_loader, context, internal_api, jinja_setup)
- models/ (User, Order, Calendar, Ticket, Product, Ghost CMS)
- db/ (SQLAlchemy async session, base)
- suma_browser/app/ (csrf, middleware, errors, authz, redis_cacher, payments, filters, utils)
- suma_browser/templates/ (shared base layouts, macros, error pages)
- static/ (CSS, JS, fonts, images)
- alembic/ (database migrations)
- config/ (app-config.yaml)
- editor/ (Lexical editor Node.js build)
- requirements.txt

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

suma_browser/app/utils/utils.py

@@ -0,0 +1,51 @@
+from quart import (
+  Response,
+  request,
+  g,
+)
+from utils import host_url
+from urllib.parse import urlencode
+
+def current_route_relative_path() -> str:
+    """
+    Returns the current request path relative to the app's mount point (script_root).
+    """
+    
+    (request.script_root or "").rstrip("/")
+    path = request.path  # excludes query string
+    
+    
+
+    if g.root and path.startswith(f"/{g.root}"):
+        rel = path[len(g.root+1):]
+        return rel if rel.startswith("/") else "/" + rel
+    return path  # app at /
+
+
+def current_url_without_page() -> str:
+    """
+    Build current URL (host+path+qs) but with ?page= removed.
+    Used for Hx-Push-Url.
+    """
+    base = host_url(current_route_relative_path())
+
+    params = request.args.to_dict(flat=False)  # keep multivals
+    params.pop("page", None)
+    qs = urlencode(params, doseq=True)
+
+    return f"{base}?{qs}" if qs else base
+
+def vary(resp: Response) -> Response:
+    """
+    Ensure caches/CDNs vary on HX headers so htmx/non-htmx versions don't get mixed.
+    """
+    v = resp.headers.get("Vary", "")
+    parts = [p.strip() for p in v.split(",") if p.strip()]
+    for h in ("HX-Request", "X-Origin"):
+        if h not in parts:
+            parts.append(h)
+    if parts:
+        resp.headers["Vary"] = ", ".join(parts)
+    return resp
+
+