feat: delta/instant upload + frontend UI/UX polish

Bundles the backend+frontend delta-upload (content-dedup) feature with a
batch of frontend fixes from this session.

Upload / dedup:
- Client-hashed delta & instant upload (deltaUpload, hashWasm vendor shim)
- Backend dedup batch endpoint (dedup_service, dedup_handler, routes)
- session store owned-hash helpers; unit tests + upload-strategy bench

Frontend UI/UX:
- Colour file-type icons in grid/list (per-type tinted tiles + glyph hue)
- Robust thumbnail fallback; PDFs now show their type icon (backend
  generates no PDF thumbnails) instead of a blank tile
- Fix PDF preview: load via a same-origin blob: iframe — the API URL is
  blocked by the global X-Frame-Options: DENY in the browser's framed
  PDF viewer, matching the existing CSP `frame-src blob:` design
- Groups: localized virtual-group description (no DB schema-note leak),
  add nav.groups to the 15 missing locales, fix primary-button contrast
- Repoint --color-text-light → --color-on-accent (was faint grey on accent)
- Nudge the admin role badge off the user-menu header divider

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

frontend/src/lib/stores/session.svelte.ts

@@ -40,6 +40,22 @@ class SessionStore {
 		return this.user;
 	}
 
+	/**
+	 * Re-fetch the authenticated user from the server, bypassing the one-shot
+	 * `load()` cache. Call after operations that change server-side user state —
+	 * chiefly storage usage after uploads / deletes — so the UI reflects the new
+	 * `storage_used_bytes` instead of the value cached at login. A transient
+	 * failure leaves the current user untouched (never logs the UI out).
+	 */
+	async refresh(): Promise<void> {
+		try {
+			const me = await fetchMe();
+			if (me) this.user = me;
+		} catch {
+			/* keep the existing user on a transient /api/auth/me failure */
+		}
+	}
+
 	/**
 	 * Resolve the caller's default personal drive's root folder — the landing
 	 * point for `/files` and the `/` redirect. Externals (grant-only) have no