Multi-day accumulated fixes: tag dispatch, session/pooling correctness, SPA rollout, jetc compiler

JetCore engine (Tag.cpp/.h, Global.cpp/.h, __*.cpp tag classes):
- Numerous __mysql.cpp connection-pooling correctness fixes (stale
  result sets, double-indirection sessionid bugs, field caching,
  pool keying) and a session-registration-before-connection-confirmed
  ordering fix (dangling pointer on a failed connect)
- Tag.cpp: large body of fixes to the tag-dispatch/container-scanning
  logic (bare-name fallback, database aliasing, single-quote handling,
  @-prefix session variable resolution, TAGDEF caching, nested split-tag
  scanning for if/while/until/ifrow so an inner one doesn't corrupt an
  outer one's own boundary scan) plus the process-first rendering
  order fix (a <process> now runs before <checksession>/page
  resolution, fixing a real "blank page after successful login" bug)
- Global.h/.cpp: added imapSessions (parallel to the existing __mysql*
  session map) for the new <imap> tag family
- __whiledir.cpp/__include.cpp: caching and directory-name-aliasing
  fixes
- __call.cpp/.h: fixed a dangling-pointer bug
- __write.cpp: fixed an O_WRONLY-only open that couldn't create a new
  file
- __ifrow.cpp/__sql.cpp: fixed the same sessionid double-indirection
  bug __mysql.cpp had (resolveKeyword's result was being used as a map
  key lookup instead of the resolved value itself)

jetc compiler (jetc/JetParser.cpp/.h, JetCodegen.cpp/.h, JetAST.h,
jetc.cpp, build-shared.sh, build-compiled.sh):
- Parser fixes: inline <include>, nested-quote handling, void-tag
  recognition
- Codegen fixes and expanded AST support
- build-shared.sh: atomic rename into place for a freshly-built .jtc
  (a live server dlopen()ing the same path mid-rebuild was corrupting
  its own already-mapped view of the old file) and a staleness check
  so a cached JetCore .o doesn't silently keep serving yesterday's
  fixes forever
- Added -lssl to both build scripts' link lines (needed once the new
  <imap> tag's client-side TLS code existed - previously nothing in
  this codebase used OpenSSL's SSL/TLS client API, only libcrypto)

Site content (jetc/barant-site/): SPA (fetch-and-swap navigation)
rollout across essentially every .page/.jet/.section/.tag/.proc/.method
file - dynamic-content fixes, fragment-mode stripping, native
$[@name] session variables replacing older mechanisms, and this
session's own checkout.page redesign, login start-param redirect fix,
and per-page side-menu (menu.bar/$[PAGE].menu) refresh support.
Completed the earlier main.css/control.css move from assets/ to
assets/images/ (git still showed the old paths as tracked-but-deleted
until now).

Deliberately left out of this commit: dozens of .pre-<description>-
<date> manual backup files (this session's and earlier ones' own
before/after snapshots, not meant for permanent history), compiled
.jtc build outputs, ad hoc test binaries and scripts under jetc/
(login_asan, wcwc_test, optest2_bin, etc.), and jetc/__pycache__/ -
none of these are meant to be tracked; a .gitignore covering them
would be worth adding separately.

__for.cpp

@@ -5,32 +5,54 @@
 namespace jet {
 
    __for::__for(coreutils::ZString &in, coreutils::MString &parentOut, Global &global, Tag *parent, Tag *local) : Tag(in, parentOut, global, parent, this) {
-      double counter = 0.0f;   
+      double counter = 0.0f;
       bool nameDefined = keywordDefined("name");
       if(keywordDefined("start")) {
 	 counter = resolveKeyword("start").asDouble();
 	 keywords["start"].reset();
       }
-      if(!keywordDefined("end")) 
+      if(!keywordDefined("end"))
 	throw coreutils::Exception("for tag requires end keyword.");
-      if(!keywordDefined("step")) 
+      if(!keywordDefined("step"))
 	throw coreutils::Exception("for tag requires step keyword.");
+
+      // Where to write the loop counter (which variables map, and under
+      // what name) is a static property of this <for>'s own invocation -
+      // "scope"/"name" have no sensible reason to change mid-loop, so
+      // resolve and branch on them once instead of re-resolving both
+      // (and re-checking scope with up to 3 comparisons) on every single
+      // iteration. Loop bounds (end/step) are deliberately left
+      // re-resolved per iteration exactly as before - real content could
+      // plausibly rely on a bound that changes as a side effect of the
+      // loop body itself, and there's no clear evidence either way, so
+      // that part stays conservative/unchanged.
+      coreutils::MString counterVarName;
+      enum { SCOPE_GLOBAL, SCOPE_LOCAL, SCOPE_PARENT } counterScope = SCOPE_GLOBAL;
+      if(nameDefined) {
+	 counterVarName = resolveKeyword("name");
+	 if(keywordDefined("scope")) {
+	    coreutils::MString scopeVal = resolveKeyword("scope");
+	    if(scopeVal == "global") counterScope = SCOPE_GLOBAL;
+	    else if(scopeVal == "local") counterScope = SCOPE_LOCAL;
+	    else if(scopeVal == "parent") counterScope = SCOPE_PARENT;
+	    else throw coreutils::Exception("scope value is not valid.");
+	 }
+      }
+
       for(double ix = counter; ix <= resolveKeyword("end").asDouble(); ix += resolveKeyword("step").asDouble()) {
 	 resolveKeyword("end").reset();
-	 resolveKeyword("step").reset();	 
+	 resolveKeyword("step").reset();
 	 if(nameDefined) {
-	    if(!keywordDefined("scope") || (resolveKeyword("scope") == "global"))
-	      global.variables[resolveKeyword("name")] = ix;
-	    else if(resolveKeyword("scope") == "local")
-	      this->local->variables[resolveKeyword("name")] = ix;
-	    else if(resolveKeyword("scope") == "parent")
-	      parent->local->variables[resolveKeyword("name")] = ix;
+	    if(counterScope == SCOPE_GLOBAL)
+	      global.variables[counterVarName] = ix;
+	    else if(counterScope == SCOPE_LOCAL)
+	      this->local->variables[counterVarName] = ix;
 	    else
-	      throw coreutils::Exception("scope value is not valid.");
-	 }	 
+	      parent->local->variables[counterVarName] = ix;
+	 }
 	 processContainer(container);
 	 container.reset();
-      }         
+      }
    }
-   
+
 }