fix(server): prevent dev toolbar injection into 204 responses

[Hartslief]

The defect

A successful DELETE request returns 204 No Content, but the development toolbar middleware does not account for 204 responses.

_stage_dev_toolbar_inject() currently checks whether dev mode is enabled and whether the response is HTML, but it does not check the response status code. Tina4 responses default to text/html; charset=utf-8, so a 204 response can pass the HTML check even though it must not contain a response body.

The toolbar is then appended to the otherwise empty response. This produces an invalid 204 response containing development-toolbar HTML, which can cause DELETE requests to fail when running in development mode.

The issue is only present with development mode enabled. Disabling dev mode bypasses the toolbar middleware and allows the DELETE request to complete successfully.

The fix

Updated _stage_dev_toolbar_inject() to skip 204 No Content responses:

if (
    not ctx.is_dev
    or not ctx.response.content_type
    or ctx.response.status_code == 204
):
    return None

This ensures the development toolbar only modifies responses that are appropriate for HTML injection.

A successful DELETE now remains:

204 No Content

with no response body, as required.

Verification

Verified the issue by testing the same DELETE request with development mode enabled and disabled.

Before the fix:

• Dev mode enabled: DELETE response failed due to the toolbar modifying the 204 response.
• Dev mode disabled: DELETE completed successfully.

After the fix:

• Dev mode enabled: DELETE completes successfully.
• The 204 response is returned without the development toolbar being injected.
• Normal HTML responses continue to receive the development toolbar.

Scope

This change is limited to the development toolbar response stage. It does not change DELETE route behaviour, database operations, or production responses.

The existing 204 No Content response from the DELETE endpoint remains unchanged; the fix prevents development middleware from modifying it.