feat(ui): one-tap confirm deeplink screen + client language

Add the /confirm/<token> SPA route and Confirm screen: a prefetch-safe button
POSTs the token via a new confirmEmailLink RPC (client/transport/mock/codec +
ConfirmLinkResult model). A login adopts the minted session and enters the app; a
link shows confirmed / merge-in-the-app; an invalid or expired token asks for a new
code. Exempt /confirm from the no-session /login redirect. Forward the client
locale on the email request (authEmailRequest gains language → app.locale) so a
fresh web login email is localised. Handle the new 'profile' live-event sub-kind by
re-fetching the profile, so a link confirmed in another browser reflects in-app at
once. i18n en+ru.

ui/src/lib/routeparse.ts

@@ -15,6 +15,7 @@ export type RouteName =
   | 'friends'
   | 'feedback'
   | 'stats'
+  | 'confirm'
   | 'notfound';
 
 export interface Route {
@@ -58,6 +59,11 @@ export function parse(hash: string): Route {
       return { name: 'feedback', params: {} };
     case 'stats':
       return { name: 'stats', params: {} };
+    case 'confirm':
+      // The one-tap email deeplink: /confirm/<token>. The token is the confirmation
+      // authorization; the screen POSTs it (prefetch-safe), so a mail scanner's GET
+      // does not consume it.
+      return { name: 'confirm', params: { token: seg[1] ?? '' } };
     default:
       return { name: 'notfound', params: {} };
   }