fix(web): console sweep — pairing, displays, stats, logs, auth, i18n

Pairing:
- Refresh the paired-devices list after a native PIN pairing (the happy path never
  invalidated it, so a newly paired device stayed hidden until remount).
- Moonlight PIN: a 204 means "PIN delivered to the waiting handshake", NOT paired, so
  it now reads "PIN sent" instead of a false "Paired successfully".
- Hide the Moonlight pairing card on native-only hosts (HostInfo.gamestream) — it could
  never receive a PIN there.
- Per-row pending on unpair/approve/deny; PIN input maxLength 16 (was 8).

Displays / Library:
- "Arrange displays" save refreshes the settings card (it rewrites the policy), without
  clobbering unsaved Custom edits (re-seed only when the draft still matches the server).
- Live-display list wrapped in QueryState so errors don't read as "no displays".
- "Forever" keep-alive option in the custom editor; edit-game form round-trips the logo
  artwork (was dropped on save); per-card delete pending.

Stats:
- Distinct colour for the native "queue" latency stage (it collided with "capture").
- "Not measured on this path" note on the GameStream health chart; configured-bitrate
  target line on throughput; host-authoritative elapsed timer; LiveCard surfaces
  non-404 errors.

Shell / auth / i18n:
- SSR-stable locale: first client render matches the base-locale SSR (no hydration
  mismatch), then adopts the persisted/browser locale post-hydration.
- BFF proxy maps an upstream (mgmt-token) 401 to 502 so a logged-in user isn't bounced
  into a post-login redirect loop.
- Logout checks the POST result before navigating; logs dedup by seq (StrictMode);
  login "next" keeps query/hash; Dashboard shows the active-session count.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/src/lib/i18n.ts

@@ -1,21 +1,61 @@
-// Thin reactive layer over Paraglide. Paraglide's `m.*` message functions and
-// `setLocale`/`getLocale` are framework-agnostic; this hook re-renders React when the
-// locale changes (Paraglide's localStorage strategy persists the choice across reloads).
+// Thin reactive layer over Paraglide, made SSR-safe.
+//
+// The problem it solves: Paraglide's client strategies (localStorage / preferredLanguage) resolve
+// the locale synchronously at load, so a `de` user's FIRST client render used German while the
+// server render (which has no localStorage / no request-locale wiring) used the base locale `en` —
+// a hydration mismatch plus a flash of English on every full page load.
+//
+// The fix: take over the READ side via `overwriteGetLocale`, returning a single `rendered` locale
+// that starts at `baseLocale`. So the server render AND the client's first (hydration) render agree
+// — no mismatch. After hydration, `adoptStoredLocale()` (called once from the root) switches to the
+// user's persisted/browser choice: one clean transition instead of a mismatch. Paraglide's strategy
+// still PERSISTS the choice (`setLocale` writes localStorage); we only own the read side.
 import { useSyncExternalStore } from "react";
-import { getLocale, locales, setLocale } from "@/paraglide/runtime";
+import {
+	baseLocale,
+	isLocale,
+	locales,
+	localStorageKey,
+	overwriteGetLocale,
+	setLocale,
+} from "@/paraglide/runtime";
 
 /** The available locales as a union (`'en' | 'de'`), derived from Paraglide's `locales`. */
 export type Locale = (typeof locales)[number];
 
+// The locale every `m.*()` renders in. Never mutated on the server (so SSR is always `baseLocale`,
+// identical across concurrent requests); mutated only in the browser, via `changeLocale`.
+let rendered: Locale = baseLocale as Locale;
+overwriteGetLocale(() => rendered);
+
 const listeners = new Set<() => void>();
 
-/** Switch locale and notify subscribers (Paraglide also persists it per its strategy). */
+/** Switch locale and notify subscribers. Persists via Paraglide's strategy (localStorage). */
 export function changeLocale(locale: Locale) {
+	rendered = locale;
 	// `reload: false` keeps the SPA mounted; we re-render via the store below.
 	setLocale(locale, { reload: false });
+	if (typeof document !== "undefined") document.documentElement.lang = locale;
 	for (const l of listeners) l();
 }
 
+/**
+ * Adopt the user's persisted (localStorage) or browser (navigator) locale — call ONCE from a root
+ * effect, AFTER hydration, so the switch never races the initial render (which must match SSR).
+ */
+export function adoptStoredLocale() {
+	if (typeof window === "undefined") return;
+	let target: Locale = baseLocale as Locale;
+	const stored = window.localStorage?.getItem(localStorageKey);
+	if (stored && isLocale(stored)) {
+		target = stored;
+	} else {
+		const nav = navigator.language?.slice(0, 2);
+		if (nav && isLocale(nav)) target = nav;
+	}
+	if (target !== rendered) changeLocale(target);
+}
+
 function subscribe(cb: () => void) {
 	listeners.add(cb);
 	return () => listeners.delete(cb);
@@ -23,7 +63,11 @@ function subscribe(cb: () => void) {
 
 /** Current locale, reactive — components using `m.*` should read this so they re-render. */
 export function useLocale(): Locale {
-	return useSyncExternalStore(subscribe, getLocale, () => "en" as Locale);
+	return useSyncExternalStore(
+		subscribe,
+		() => rendered,
+		() => baseLocale as Locale,
+	);
 }
 
 export { locales };