// Shared plumbing for every page: CSRF-injecting fetch, theme toggle, // sidebar toggle (mobile), and small formatting helpers. No framework, // no build step -- plain scripts, load order handled by