security: fix vulnerabilities 1-7 from security audit

- Fix #1: Share handler IDOR - enforce owner check on share operations
- Fix #2: list_files_query IDOR - bind folder queries to authenticated user
- Fix #3: Dedup handler IDOR - restrict dedup operations to file owner
- Fix #4: Trash handler OptionalAuthUser - require full AuthUser
- Fix #5: Error info leakage - sanitize 500 error responses
- Fix #6: Chunked upload IDOR - bind upload sessions to user_id,
  add verify_session_owner() check on all session operations
- Fix #7: CSP unsafe-inline removal - migrate all inline scripts,
  styles and event handlers to external files, tighten CSP to
  script-src 'self'; style-src 'self'

New files:
  - static/js/core/theme-init.js (render-blocking theme init)
  - static/js/core/sw-register.js (service worker registration)
  - static/css/views/device-verify.css (extracted inline styles)
  - static/js/views/device-verify/device-verify.js (extracted inline script)

src/interfaces/api/handlers/i18n_handler.rs

@@ -56,16 +56,22 @@ impl I18nHandler {
                 (StatusCode::OK, Json(response)).into_response()
             }
             Err(err) => {
-                let status = match &err {
-                    I18nError::KeyNotFound(_) => StatusCode::NOT_FOUND,
-                    I18nError::InvalidLocale(_) => StatusCode::BAD_REQUEST,
-                    I18nError::LoadError(_) => StatusCode::INTERNAL_SERVER_ERROR,
+                let (status, error_msg) = match &err {
+                    I18nError::KeyNotFound(_) => (StatusCode::NOT_FOUND, err.to_string()),
+                    I18nError::InvalidLocale(_) => (StatusCode::BAD_REQUEST, err.to_string()),
+                    I18nError::LoadError(_) => {
+                        tracing::error!("I18n load error: {}", err);
+                        (
+                            StatusCode::INTERNAL_SERVER_ERROR,
+                            "Translation loading error".to_string(),
+                        )
+                    }
                 };
 
                 let error = TranslationErrorDto {
                     key: query.key,
                     locale: locale.unwrap_or(Locale::default()).as_str().to_string(),
-                    error: err.to_string(),
+                    error: error_msg,
                 };
 
                 (status, Json(error)).into_response()