fix: resolve tag autocomplete click bug and display name fallback

Tag autocomplete suggestions were silently broken by CSP (script-src
'self') which blocks inline event handlers. Replaced onclick attributes
with data-tag-name + delegated mousedown/touchend listeners in app.js.
Also changed hx-params="*" to hx-params="none" to avoid sending
unrelated form fields to the search endpoint.

Display name in "av <name>" on fave cards was empty for users without
a custom display name. Changed SQL queries to use
COALESCE(NULLIF(u.display_name, ''), u.username) for automatic fallback.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/templates/partials/tag_suggestions.html

@@ -2,6 +2,6 @@
     id="tag-option-{{$i}}"
     class="tag-suggestion"
     aria-selected="false"
-    onclick="addTag(this, '{{$tag.Name}}')"
+    data-tag-name="{{$tag.Name}}"
     tabindex="-1">{{$tag.Name}}</li>
 {{end}}