feat(i18n): serve every page in 30 languages

The interface ships translated; page content stays English until a
LibreTranslate instance fills app/i18n/content/ through make i18n. A string
without a catalogue entry falls back to its English source, so a half-filled
catalogue degrades instead of breaking.

Translation runs after ConfigurationResolver.resolve_links(), on a copy.
resolve_links matches by the `name` field, so translating it beforehand
would break every `link:` reference in the configuration.

negotiate() normalises to the primary subtag itself. Werkzeug's best_match
returns an exact match before it considers a primary-tag fallback, so the
Chrome default `de-DE,en;q=0.8` resolves to English there. "/" carries
Vary: Accept-Language, without which a shared cache pins the first
visitor's language for everyone.

The route rule lists the known codes as a converter argument. A bare
"/<lang>/" answers /robots.txt and /favicon.ico with a permanently
cacheable 308 to their trailing-slash form.

Templates gain lang, dir, the RTL stylesheet, a canonical URL and 30
hreflang alternates. Those are the first external URLs in this app:
ProxyFix takes the scheme from X-Forwarded-Proto so they do not claim
http:// behind a TLS-terminating proxy, X-Forwarded-Host stays untrusted
because nginx passes a client-supplied one through, and TRUSTED_HOSTS lets
Flask reject a forged Host outright.

Flask only autoescapes .html/.htm/.xml/.xhtml/.svg, so every *.html.j2
template interpolated configuration raw. Enabling it changes two lines of
the shipped page, both an apostrophe.

read_catalog degrades an unreadable catalogue to English rather than
serving a 500, and drops non-string entries that would otherwise render as
"42". i18n_sync writes atomically, never overwrites an existing entry,
refuses to touch a catalogue it could not parse, and leaves the file alone
when a run translated nothing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/lint/test_tooling_configuration.py

@@ -0,0 +1,78 @@
+"""Guards for configuration that no other test observes.
+
+Each assertion here stands for a defect that was found by deleting the line it
+checks: the deletion is invisible to every suite, and its effect only shows up
+in production or in a fresh checkout.
+"""
+
+import re
+import tomllib
+import unittest
+from pathlib import Path
+
+import yaml
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+
+
+class TestYamllintConfiguration(unittest.TestCase):
+    def setUp(self):
+        self.config = yaml.safe_load(
+            (REPO_ROOT / ".yamllint").read_text(encoding="utf-8")
+        )
+
+    def test_duplicate_keys_are_an_error(self):
+        self.assertEqual(self.config["rules"]["key-duplicates"], "enable")
+
+    def test_the_directories_that_collect_foreign_yaml_are_ignored(self):
+        ignored = self.config["ignore"].split()
+
+        self.assertGreaterEqual(
+            set(ignored),
+            {".git/", ".venv/", "node_modules/", "app/node_modules/"},
+        )
+
+
+class TestRunTargets(unittest.TestCase):
+    def setUp(self):
+        self.makefile = (REPO_ROOT / "Makefile").read_text(encoding="utf-8")
+        self.recipes = {
+            name: body
+            for name, body in re.findall(
+                r"^(run-dev|run-prod):[^\n]*\n((?:\t[^\n]*\n)+)",
+                self.makefile,
+                re.MULTILINE,
+            )
+        }
+
+    def test_both_run_targets_exist(self):
+        self.assertEqual(set(self.recipes), {"run-dev", "run-prod"})
+
+    def test_the_container_is_told_which_hosts_are_trusted(self):
+        for name, body in self.recipes.items():
+            with self.subTest(target=name):
+                self.assertIn("TRUSTED_HOSTS", body)
+
+    def test_the_container_is_told_which_port_to_bind(self):
+        for name, body in self.recipes.items():
+            with self.subTest(target=name):
+                self.assertIn('-e PORT="$$PORT"', body)
+
+    def test_the_whole_env_file_is_not_handed_to_the_web_container(self):
+        for name, body in self.recipes.items():
+            with self.subTest(target=name):
+                self.assertNotIn("--env-file", body)
+
+
+class TestPackagedCatalogs(unittest.TestCase):
+    def test_the_interface_catalogs_are_declared_as_package_data(self):
+        with (REPO_ROOT / "pyproject.toml").open("rb") as handle:
+            pyproject = tomllib.load(handle)
+
+        package_data = pyproject["tool"]["setuptools"]["package-data"]["app"]
+
+        self.assertIn("i18n/ui/*.yaml", package_data)
+
+
+if __name__ == "__main__":
+    unittest.main()