feat(ui): one-tap confirm deeplink screen + client language

Add the /confirm/<token> SPA route and Confirm screen: a prefetch-safe button
POSTs the token via a new confirmEmailLink RPC (client/transport/mock/codec +
ConfirmLinkResult model). A login adopts the minted session and enters the app; a
link shows confirmed / merge-in-the-app; an invalid or expired token asks for a new
code. Exempt /confirm from the no-session /login redirect. Forward the client
locale on the email request (authEmailRequest gains language → app.locale) so a
fresh web login email is localised. Handle the new 'profile' live-event sub-kind by
re-fetching the profile, so a link confirmed in another browser reflects in-app at
once. i18n en+ru.

ui/src/lib/model.ts

@@ -355,6 +355,15 @@ export interface LinkResult {
   session: Session | null;
 }
 
+// ConfirmLinkResult is the outcome of a one-tap deeplink confirmation. purpose is
+// 'login' (session carries the minted credential to sign in) or 'link' (status is
+// 'confirmed' or 'merge_required' — the app finishes any merge from its manual flow).
+export interface ConfirmLinkResult {
+  purpose: 'login' | 'link';
+  status: 'confirmed' | 'merge_required';
+  session: Session | null;
+}
+
 export interface MatchResult {
   matched: boolean;
   game?: GameView;