phase 7+: i18n primitive + login language picker + autocomplete-off

Adds a minimal Svelte 5 i18n primitive (`src/lib/i18n/`) backing the
login form, the layout blocker page, and the lobby placeholder.
SUPPORTED_LOCALES drives both the picker and the runtime lookup;
adding a language is a two-step change inside `src/lib/i18n/`.

Login form gains a globe-icon language dropdown (English / Русский
in their native names), defaulting to navigator.languages with `en`
as the fallback. Switching the locale re-renders the form in place;
on submit, the locale rides in the JSON body of `send-email-code`
because Safari/WebKit silently drops JS-set Accept-Language. Gateway
gains a body `locale` field that takes priority over the request
header for preferred-language resolution.

Email and code inputs disable browser autofill / suggestions
(`autocomplete=off` + `autocorrect=off` + `autocapitalize=off` +
`spellcheck=false`) so Keychain / address-book pickers and
remembered-value dropdowns no longer fire on focus.

Cross-cuts:
- backend & gateway openapi: clarify that body `locale` is honored.
- docs/FUNCTIONAL{,_ru}.md §1.2: document body-vs-header priority.
- gateway tests: body `locale` overrides Accept-Language; blank
  body `locale` falls back to header.
- new ui/docs/i18n.md; cross-links from auth-flow.md and ui/README.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ui/docs/auth-flow.md

@@ -125,6 +125,24 @@ the stream the moment it observes a `session_invalidation` push
 event from backend, and the watcher reacts on the next event-loop
 tick.
 
+## Localisation
+
+The login form, the root layout's blocker page, and the lobby
+placeholder go through the i18n primitive in `src/lib/i18n/`. The
+language picker on `/login` lists every entry in
+`SUPPORTED_LOCALES` by its native name and is initialised from
+`navigator.languages` (web) with `en` as the fallback. Picking a
+different language re-renders the form in place and is forwarded
+to the gateway in the JSON body of `send-email-code` (`locale`
+field) — the body channel is the canonical one because Safari
+drops JS-set `Accept-Language` headers. See
+[`i18n.md`](i18n.md) for the architecture and the recipe for
+adding a new language.
+
+The locale is **not** persisted between page reloads; detection
+runs again on every visit. Phase 35's full polish pass will
+revisit persistence and add message-format pluralisation.
+
 ## Configuration
 
 Build-time environment, read by `lib/env.ts`: