Patch the catalog in place instead of navigating

Deleting a dish partway down the list sent the browser back to the top. The
first attempt at fixing it used anchors, which cannot work: the browser
positions the element with no knowledge of where the page was scrolled, so it
still jumps. Datastar was already loaded and doing nothing but search.

Every catalog action now patches. The bin, the pencil and Peruuta stay real
links; the forms stay real forms. Datastar intercepts them with
data-on:click__prevent and data-on:submit__prevent, and the same handlers
redirect when the Datastar-Request header is absent, so none of it requires
JavaScript. Posting with {contentType: 'form'} sends the enclosing form as
FormData, which means the handlers keep reading r.FormValue and no input had
to be rewritten as a signal.

The response is one SSE event carrying three elements: the list and both
forms. They have to move together — opening an edit form also has to clear a
delete that was mid-confirmation — and a text/html response can only replace
one element. The writer is twenty lines rather than re-adding the SDK and the
four modules it brings for a generator we would otherwise never call.

Smoke checks assert the wire format: that these answer with an event stream
carrying all three elements, that the deleted dish is absent from the patched
list, and that a header-less post still redirects.

scripts/smoke.sh

@@ -268,9 +268,34 @@ check "the bin asks before deleting" \
 check "the dish is still there while it asks" \
 	"$(curl -s -u ":$pass" "http://$addr/ruuat?poista=$uusi&tyyppi=paa")" "Uunikala"
 
-check "confirming the delete redirects back to the catalog" \
-	"$(curl -s -o /dev/null -w '%{redirect_url}' -u ":$pass" \
+# ---- the catalog patches in place instead of navigating -----------------
+
+# A delete confirmation halfway down a long list must not send the browser
+# back to the top, so these answer with a Datastar patch rather than a page.
+patch=$(curl -s -u ":$pass" -H 'Datastar-Request: true' \
+	"http://$addr/ruuat/nayta?poista=$uusi&tyyppi=paa")
+check "asking to delete patches rather than navigates" "$patch" "event: datastar-patch-elements"
+check "the patch carries the list" "$patch" 'id="ruokalista"'
+check "and both forms, so an open one closes" "$patch" 'id="paaruoka"'
+check "the row it patches in is asking" "$patch" "Poista?"
+
+check "patches are served as an event stream" \
+	"$(curl -s -o /dev/null -w '%{content_type}' -u ":$pass" -H 'Datastar-Request: true' \
+		"http://$addr/ruuat/nayta")" "text/event-stream"
+
+check "deleting from Datastar patches too" \
+	"$(curl -s -u ":$pass" -H 'Datastar-Request: true' \
 		-d "id=$uusi&tyyppi=paa" "http://$addr/ruuat/poista")" \
+	"event: datastar-patch-elements"
+
+refute "and the dish is gone from the patched list" \
+	"$(curl -s -u ":$pass" -H 'Datastar-Request: true' "http://$addr/ruuat/nayta")" \
+	"Uunikala"
+
+# Without the header it must still be an ordinary redirect, for no JavaScript.
+check "a plain form post still redirects" \
+	"$(curl -s -o /dev/null -w '%{redirect_url}' -u ":$pass" \
+		-d 'nimi=Testiruoka&kategoria=fish' "http://$addr/ruuat/paaruoka")" \
 	"/ruuat"
 
 refute "the dish is gone once confirmed" \