add tag listings, global and section-narrowed

One global namespace (ADR-0018): /tags/{term}/ spans every section and
/{section}/tags/{term}/ narrows it. Listings group by section so one busy term
stays readable, which needed List.Groups alongside Items — list.html renders
whichever is set.

This is Query's second use, so it gained a Tag field rather than being generalised
on speculation: one filter, two callers. Tag slugs lowercase and hyphenate,
preserving script, so "Long Monsoon" and "long monsoon" are one term while Bengali
passes through unchanged. Hand-chosen slugs per term still wait for the type
declaration that owns overrides.

`tags` is reserved at the top level and inside every section, alongside `page` and
the language prefixes. A tag listing redirects to its canonical URL only once it is
known to exist, matching the rule bundles already followed — otherwise a canonical
URL for nothing confirms what is not there.

One stale test expectation fixed rather than worked around: it asserted tags land
in Extra, which stopped being true when tags became a named field.

Evidence: /tags/monsoon/ lists Hello World under posts and First Rain under comics;
/comics/tags/monsoon/ shows one; /tags/monsoon 301s; /tags/nothing/ and /tags/ 404.

internal/web/web.go

@@ -68,11 +68,41 @@ func serveListing(w http.ResponseWriter, req *http.Request, site *content.Site,
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return true
 	}
+	write(w, out, res.key)
+	return true
+}
+
+// serveTags answers a tag listing, grouped by section so a busy term stays readable (ADR-0018).
+func serveTags(w http.ResponseWriter, req *http.Request, site *content.Site, r *render.Renderer, res resolution) bool {
+	items := site.Run(content.Query{Section: res.key, Tag: res.tag, Lang: res.lang})
+	if len(items) == 0 {
+		return false
+	}
+	if res.page > 1 && (res.page-1)*content.PerPage >= len(items) {
+		return false
+	}
+	// Redirect only once the listing is known to exist, the same rule bundles follow: a canonical URL for
+	// nothing would confirm what is not there.
+	if res.redirect != "" {
+		http.Redirect(w, req, res.redirect, http.StatusMovedPermanently)
+		return true
+	}
+	out, err := r.Tag(res.key, res.tag, res.lang, items, res.page)
+	if err != nil {
+		slog.Error("tag listing failed", "tag", res.tag, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return true
+	}
+	write(w, out, res.tag)
+	return true
+}
+
+// write sends a rendered page, logging a failed write rather than pretending it succeeded.
+func write(w http.ResponseWriter, out []byte, what string) {
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	if _, err := w.Write(out); err != nil {
-		slog.Warn("write failed", "section", res.key, "err", err)
+		slog.Warn("write failed", "what", what, "err", err)
 	}
-	return true
 }
 
 // serve resolves one request and writes its bundle.
@@ -82,6 +112,12 @@ func serve(w http.ResponseWriter, req *http.Request, site *content.Site, r *rend
 		http.NotFound(w, req)
 		return
 	}
+	if res.tag != "" {
+		if !serveTags(w, req, site, r, res) {
+			http.NotFound(w, req)
+		}
+		return
+	}
 	// A redirect target only exists for a path that resolves, so check the bundle before sending one:
 	// otherwise a nonexistent page answers 301 and confirms nothing.
 	b, served, found := site.Lookup(res.key, res.lang)
@@ -110,8 +146,5 @@ func serve(w http.ResponseWriter, req *http.Request, site *content.Site, r *rend
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	if _, err := w.Write(out); err != nil {
-		slog.Warn("write failed", "key", b.Key, "err", err)
-	}
+	write(w, out, b.Key)
 }