phase 7+: i18n primitive + login language picker + autocomplete-off

Adds a minimal Svelte 5 i18n primitive (`src/lib/i18n/`) backing the
login form, the layout blocker page, and the lobby placeholder.
SUPPORTED_LOCALES drives both the picker and the runtime lookup;
adding a language is a two-step change inside `src/lib/i18n/`.

Login form gains a globe-icon language dropdown (English / Русский
in their native names), defaulting to navigator.languages with `en`
as the fallback. Switching the locale re-renders the form in place;
on submit, the locale rides in the JSON body of `send-email-code`
because Safari/WebKit silently drops JS-set Accept-Language. Gateway
gains a body `locale` field that takes priority over the request
header for preferred-language resolution.

Email and code inputs disable browser autofill / suggestions
(`autocomplete=off` + `autocorrect=off` + `autocapitalize=off` +
`spellcheck=false`) so Keychain / address-book pickers and
remembered-value dropdowns no longer fire on focus.

Cross-cuts:
- backend & gateway openapi: clarify that body `locale` is honored.
- docs/FUNCTIONAL{,_ru}.md §1.2: document body-vs-header priority.
- gateway tests: body `locale` overrides Accept-Language; blank
  body `locale` falls back to header.
- new ui/docs/i18n.md; cross-links from auth-flow.md and ui/README.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ui/frontend/src/api/auth.ts

@@ -22,6 +22,20 @@ export interface SendEmailCodeResult {
 	challengeId: string;
 }
 
+export interface SendEmailCodeOptions {
+	/**
+	 * locale is forwarded inside the JSON body and read by the
+	 * gateway in preference to the request `Accept-Language` header.
+	 * The body field is the canonical channel because Safari/WebKit
+	 * silently drops JS-set `Accept-Language` headers, while the
+	 * body round-trips correctly on every supported engine. When the
+	 * caller omits this option the browser-default Accept-Language
+	 * remains the gateway's only signal and the auth-mail uses the
+	 * system locale.
+	 */
+	locale?: string;
+}
+
 export interface ConfirmEmailCodeInput {
 	challengeId: string;
 	code: string;
@@ -61,24 +75,32 @@ export class AuthError extends Error {
 export async function sendEmailCode(
 	baseUrl: string,
 	email: string,
+	options?: SendEmailCodeOptions,
 ): Promise<SendEmailCodeResult> {
+	const requestBody: Record<string, string> = { email };
+	if (options?.locale !== undefined && options.locale !== "") {
+		requestBody.locale = options.locale;
+	}
 	const response = await fetch(joinUrl(baseUrl, SEND_EMAIL_CODE_PATH), {
 		method: "POST",
 		headers: { "content-type": "application/json" },
-		body: JSON.stringify({ email }),
+		body: JSON.stringify(requestBody),
 	});
 	if (!response.ok) {
 		throw await readAuthError(response);
 	}
-	const body = (await response.json()) as { challenge_id?: unknown };
-	if (typeof body.challenge_id !== "string" || body.challenge_id.length === 0) {
+	const responseBody = (await response.json()) as { challenge_id?: unknown };
+	if (
+		typeof responseBody.challenge_id !== "string" ||
+		responseBody.challenge_id.length === 0
+	) {
 		throw new AuthError(
 			"internal_error",
 			"gateway returned a malformed send-email-code response",
 			response.status,
 		);
 	}
-	return { challengeId: body.challenge_id };
+	return { challengeId: responseBody.challenge_id };
 }
 
 /**