phase 7+: i18n primitive + login language picker + autocomplete-off

Adds a minimal Svelte 5 i18n primitive (`src/lib/i18n/`) backing the
login form, the layout blocker page, and the lobby placeholder.
SUPPORTED_LOCALES drives both the picker and the runtime lookup;
adding a language is a two-step change inside `src/lib/i18n/`.

Login form gains a globe-icon language dropdown (English / Русский
in their native names), defaulting to navigator.languages with `en`
as the fallback. Switching the locale re-renders the form in place;
on submit, the locale rides in the JSON body of `send-email-code`
because Safari/WebKit silently drops JS-set Accept-Language. Gateway
gains a body `locale` field that takes priority over the request
header for preferred-language resolution.

Email and code inputs disable browser autofill / suggestions
(`autocomplete=off` + `autocorrect=off` + `autocapitalize=off` +
`spellcheck=false`) so Keychain / address-book pickers and
remembered-value dropdowns no longer fire on focus.

Cross-cuts:
- backend & gateway openapi: clarify that body `locale` is honored.
- docs/FUNCTIONAL{,_ru}.md §1.2: document body-vs-header priority.
- gateway tests: body `locale` overrides Accept-Language; blank
  body `locale` falls back to header.
- new ui/docs/i18n.md; cross-links from auth-flow.md and ui/README.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/openapi.yaml

@@ -2303,7 +2303,13 @@ components:
           format: email
         locale:
           type: string
-          description: Optional BCP 47 locale tag preferred for the delivered code.
+          description: |
+            Optional BCP 47 locale tag preferred for the delivered code.
+            Read by the gateway in preference to the request
+            `Accept-Language` header so Safari clients (which silently
+            drop JS-set `Accept-Language`) can still pick a non-system
+            mail language. Empty / malformed values fall back to the
+            header, which in turn falls back to `en`.
     PublicAuthSendEmailCodeResponse:
       type: object
       additionalProperties: false