Page the history and search both lists as you type

Two changes that keep the lists usable after years of entries, and the first
real use of the Datastar client that has been shipping unused.

Paging: history() now walks back from any given day and returns the rows plus
whether older ones exist. The page shows a 30-day window and "Näytä lisää"
grows it by another 30 through ?paivat=, capped at five years so a
hand-edited URL cannot ask for a decade of rows at once. Two tests check that
consecutive windows meet exactly, repeating no day and skipping none, which
is the mistake this shape invites.

Live search: both search boxes bind to a Datastar signal and re-render their
list 250 ms after typing stops. The board search and the catalog search each
return only their own fragment, and the catalog search covers sides as well
as mains.

Three things worth knowing about the Datastar side. Its attribute syntax is
colon-separated in v1.0.3 — data-on:input, not data-on-input; the dashed form
parses as a plugin named "on-input", matches nothing, and fails silently. A
plain text/html response is accepted and matched to the element by id, so
there is no SSE stream to manage and the SDK is used only for ReadSignals.
And both boxes are still ordinary GET forms, so ?haku= filters server-side
with JavaScript off: the live version is an enhancement, not a requirement.

Smoke checks send the real ?datastar={"haku":"..."} wire format and assert
the response is a fragment rather than a whole page.

scripts/smoke.sh

@@ -150,6 +150,28 @@ check "the day is empty again" \
 check "search filters the board" \
 	"$(curl -s -u ":$pass" "http://$addr/?haku=keitto")" "keitto"
 
+# ---- live search: Datastar sends signals as JSON in ?datastar= -----------
+
+live=$(curl -s -u ":$pass" --get --data-urlencode 'datastar={"haku":"keitto"}' "http://$addr/etsi")
+check "live search returns the board fragment" "$live" 'id="lauta"'
+check "live search applies the term" "$live" "keitto"
+refute "live search excludes non-matches" "$live" "Lihapullat"
+refute "the fragment is not a whole page" "$live" "<html"
+
+check "live search is served as html for Datastar to patch" \
+	"$(curl -s -o /dev/null -w '%{content_type}' -u ":$pass" \
+		--get --data-urlencode 'datastar={"haku":"keitto"}' "http://$addr/etsi")" \
+	"text/html"
+
+cat_live=$(curl -s -u ":$pass" --get --data-urlencode 'datastar={"haku":"riisi"}' "http://$addr/ruuat/etsi")
+check "catalog live search returns its fragment" "$cat_live" 'id="ruokalista"'
+check "catalog live search matches sides too" "$cat_live" "Riisi"
+refute "catalog live search excludes non-matches" "$cat_live" "Lihapullat"
+
+# The plain form still works without JavaScript.
+check "catalog search works as a plain form too" \
+	"$(curl -s -u ":$pass" "http://$addr/ruuat?haku=riisi")" "Riisi"
+
 # Nothing was eaten tomorrow. A future date is clamped rather than logged.
 future=$(date -d '+30 days' +%Y-%m-%d)
 check "a future date falls back to today" \