Add an English/Czech interface language switch

English stays the default; Czech is a full translation. Only the app chrome
is translated - notes and generated decks keep their own language, which is a
core feature, not a setting.

i18n
- lib/i18n-dict.ts: flat en/cs dictionaries (441 keys each), translate() and
  translatePlural() with real Czech plural rules (1 sada / 2-4 sady / 5+ sad).
  English is the default and the fallback for a missing key.
- lib/i18n.ts: browser store (freezmo.locale.v1), useI18n() hook, and the
  x-freezmo-locale header. The hook's t/plural are bound to the locale React
  is rendering with, so the first client render matches the server HTML and
  then re-renders in the stored language; module-level t is only for event
  handlers and non-React helpers.
- <html lang> follows the choice (inline script + setLocale).

UI
- Settings -> Language segmented control (English / Cestina), plus an EN/CS
  button on the key gate for first run.
- Every screen translated: sidebar, header, tab bar, library, deck cards,
  folder bar, create flow, all seven activities, study chrome, results,
  settings + health panel, API-key gate and help, install sheet, offline and
  the deck-not-found page.
- Plural-aware counts everywhere (decks, folders, activities, runs, photos,
  documents, pages, words, wrong attempts).

Server
- API routes and guards (generate, grade, health, http-guard, rate-limit,
  ollama error mapping) answer in the request's language, so error cards and
  the health panel never fall back to English mid-sentence.

Fixes
- A hydration mismatch when a non-default locale was stored silently dropped
  the .dark class after hydration; render-time t() is now bound to the
  hook's locale (UploadScreen.describeExtraction, ResultsScreen.answerFor,
  DeckCard's folder fallback).
- Bumped the service worker cache to freezmo-v4 for this deploy.

Tests: i18n 27/27 (gate toggle, persistence, html lang, Czech plurals,
settings switch) and a rebuilt regression suite 72/72 (English default,
library, create, all 7 activity types, results, settings, install sheet,
offline, PWA, security, Czech smoke).

app/api/health/route.ts

@@ -1,6 +1,8 @@
-import { AUTH_ERROR_MESSAGES, authErrorKind, canonicalModelName, getServerConfig, resolveAuth, resolveModelName, type AuthMode } from "@/lib/config";
+import { authErrorMessage, authErrorKind, canonicalModelName, getServerConfig, resolveAuth, resolveModelName, type AuthMode } from "@/lib/config";
 import { friendlyErrorMessage, ollamaListModels, ollamaVerifyKey, OllamaError } from "@/lib/ollama";
 import { clientKey, rateLimit, rateLimitResponse } from "@/lib/rate-limit";
+import { requestLocale } from "@/lib/http-guard";
+import { translate } from "@/lib/i18n-dict";
 
 export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
@@ -33,10 +35,11 @@ export type HealthResponse = {
 };
 
 export async function GET(request: Request) {
+  const locale = requestLocale(request);
   const config = getServerConfig();
 
   const limit = rateLimit(`health:${clientKey(request)}`, config.rateLimits.health, config.rateLimits.windowMs);
-  if (!limit.allowed) return rateLimitResponse(limit);
+  if (!limit.allowed) return rateLimitResponse(limit, locale);
 
   const started = Date.now();
   const resolvedAuth = resolveAuth(config, request);
@@ -69,8 +72,8 @@ export async function GET(request: Request) {
   if ("error" in resolvedAuth) {
     health.error =
       resolvedAuth.error === "missing_key"
-        ? "No Ollama API key yet. Add your key in the settings dialog — it is stored only in this browser."
-        : AUTH_ERROR_MESSAGES[resolvedAuth.error];
+        ? translate(locale, "server.healthNoKey")
+        : authErrorMessage(locale, resolvedAuth.error);
     health.kind = authErrorKind(resolvedAuth.error);
     return Response.json(health satisfies HealthResponse, { headers: { "Cache-Control": "no-store" } });
   }
@@ -87,12 +90,12 @@ export async function GET(request: Request) {
       const probe = await ollamaVerifyKey(resolvedAuth.auth, config.textModel, config.healthTimeoutMs * 3);
       health.keyAccepted = probe.valid;
       if (probe.valid === false) {
-        health.error = "Ollama rejected this API key. Create a new one at ollama.com/settings/keys and paste it again.";
+        health.error = translate(locale, "server.healthKeyRejected");
         health.kind = "auth";
         return Response.json(health satisfies HealthResponse, { headers: { "Cache-Control": "no-store" } });
       }
       if (probe.reason === "no_credits") {
-        health.error = `The key works, but ${config.textModel} is not included in this account's plan. Add usage credits or switch to a free-tier model in .env.local.`;
+        health.error = translate(locale, "server.healthNoCredits", { model: config.textModel });
         health.kind = "no_credits";
       }
     }
@@ -106,17 +109,17 @@ export async function GET(request: Request) {
       if (!listed) {
         entry.note =
           health.mode === "local-daemon"
-            ? `Not in the daemon's model list. Run \`ollama pull ${entry.resolved}\` or check your sign-in.`
-            : `Not returned by ${config.baseUrl}/api/tags. Check the model name and your key's plan.`;
+            ? translate(locale, "server.healthModelNoteLocal", { model: entry.resolved })
+            : translate(locale, "server.healthModelNoteCloud", { url: config.baseUrl });
       }
     }
 
     health.ok = Boolean(health.vision.available && health.text.available && health.keyAccepted !== false);
     if (!health.ok && !health.error) {
-      health.error = "Ollama is reachable, but at least one configured model is not available.";
+      health.error = translate(locale, "server.healthModelsMissing");
     }
   } catch (error) {
-    health.error = friendlyErrorMessage(error, config.baseUrl);
+    health.error = friendlyErrorMessage(error, config.baseUrl, locale);
     health.kind = error instanceof OllamaError ? error.kind : "unknown";
     if (error instanceof OllamaError && (error.kind === "auth" || error.kind === "http")) {
       health.keyAccepted = false;