Add an English/Czech interface language switch

English stays the default; Czech is a full translation. Only the app chrome
is translated - notes and generated decks keep their own language, which is a
core feature, not a setting.

i18n
- lib/i18n-dict.ts: flat en/cs dictionaries (441 keys each), translate() and
  translatePlural() with real Czech plural rules (1 sada / 2-4 sady / 5+ sad).
  English is the default and the fallback for a missing key.
- lib/i18n.ts: browser store (freezmo.locale.v1), useI18n() hook, and the
  x-freezmo-locale header. The hook's t/plural are bound to the locale React
  is rendering with, so the first client render matches the server HTML and
  then re-renders in the stored language; module-level t is only for event
  handlers and non-React helpers.
- <html lang> follows the choice (inline script + setLocale).

UI
- Settings -> Language segmented control (English / Cestina), plus an EN/CS
  button on the key gate for first run.
- Every screen translated: sidebar, header, tab bar, library, deck cards,
  folder bar, create flow, all seven activities, study chrome, results,
  settings + health panel, API-key gate and help, install sheet, offline and
  the deck-not-found page.
- Plural-aware counts everywhere (decks, folders, activities, runs, photos,
  documents, pages, words, wrong attempts).

Server
- API routes and guards (generate, grade, health, http-guard, rate-limit,
  ollama error mapping) answer in the request's language, so error cards and
  the health panel never fall back to English mid-sentence.

Fixes
- A hydration mismatch when a non-default locale was stored silently dropped
  the .dark class after hydration; render-time t() is now bound to the
  hook's locale (UploadScreen.describeExtraction, ResultsScreen.answerFor,
  DeckCard's folder fallback).
- Bumped the service worker cache to freezmo-v4 for this deploy.

Tests: i18n 27/27 (gate toggle, persistence, html lang, Czech plurals,
settings switch) and a rebuilt regression suite 72/72 (English default,
library, create, all 7 activity types, results, settings, install sheet,
offline, PWA, security, Czech smoke).

lib/http-guard.ts

@@ -1,3 +1,5 @@
+import { LOCALE_HEADER, normaliseLocale, translate } from "./i18n-dict";
+
 /**
  * Small server-side guards shared by the API routes.
  *
@@ -6,6 +8,11 @@
  * bodies exhausting memory, and (c) odd values ending up in outbound headers.
  */
 
+/** The language this request asked for (browsers send x-freezmo-locale). */
+export function requestLocale(request: Request) {
+  return normaliseLocale(request.headers.get(LOCALE_HEADER));
+}
+
 function formatBytes(bytes: number): string {
   if (bytes < 1024 * 1024) return `${Math.max(1, Math.round(bytes / 1024))} KB`;
   return `${(bytes / 1024 / 1024).toFixed(bytes < 10 * 1024 * 1024 ? 1 : 0)} MB`;
@@ -19,7 +26,10 @@ export function rejectOversizedBody(request: Request, maxBytes: number): Respons
   if (Number.isFinite(length) && length > maxBytes) {
     return Response.json(
       {
-        error: `Request body is too large (${formatBytes(length)}). Limit is ${formatBytes(maxBytes)}.`,
+        error: translate(requestLocale(request), "server.bodyTooLarge", {
+          size: formatBytes(length),
+          limit: formatBytes(maxBytes),
+        }),
         kind: "too_large",
       },
       { status: 413 },
@@ -46,7 +56,10 @@ export function rejectCrossOrigin(request: Request): Response | null {
   try {
     originHost = new URL(origin).host;
   } catch {
-    return Response.json({ error: "Invalid Origin header.", kind: "forbidden" }, { status: 403 });
+    return Response.json(
+      { error: translate(requestLocale(request), "server.invalidOrigin"), kind: "forbidden" },
+      { status: 403 },
+    );
   }
 
   const host = request.headers.get("host");
@@ -62,7 +75,7 @@ export function rejectCrossOrigin(request: Request): Response | null {
   if (loopback.has(bare(originHost)) && loopback.has(bare(host ?? ""))) return null;
 
   return Response.json(
-    { error: "Cross-origin requests are not allowed.", kind: "forbidden" },
+    { error: translate(requestLocale(request), "server.crossOrigin"), kind: "forbidden" },
     { status: 403 },
   );
 }