feat: delta/instant upload + frontend UI/UX polish

Bundles the backend+frontend delta-upload (content-dedup) feature with a
batch of frontend fixes from this session.

Upload / dedup:
- Client-hashed delta & instant upload (deltaUpload, hashWasm vendor shim)
- Backend dedup batch endpoint (dedup_service, dedup_handler, routes)
- session store owned-hash helpers; unit tests + upload-strategy bench

Frontend UI/UX:
- Colour file-type icons in grid/list (per-type tinted tiles + glyph hue)
- Robust thumbnail fallback; PDFs now show their type icon (backend
  generates no PDF thumbnails) instead of a blank tile
- Fix PDF preview: load via a same-origin blob: iframe — the API URL is
  blocked by the global X-Frame-Options: DENY in the browser's framed
  PDF viewer, matching the existing CSP `frame-src blob:` design
- Groups: localized virtual-group description (no DB schema-note leak),
  add nav.groups to the 15 missing locales, fix primary-button contrast
- Repoint --color-text-light → --color-on-accent (was faint grey on accent)
- Nudge the admin role badge off the user-menu header divider

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

frontend/src/routes/groups/+page.svelte

@@ -6,6 +6,7 @@
 		addUserMember,
 		createGroup,
 		deleteGroup,
+		groupDescription,
 		groupDisplayName,
 		groupIconName,
 		INTERNAL_GROUP_ID,
@@ -243,6 +244,7 @@
 	{:else}
 		<ul class="list">
 			{#each groups as g (g.id)}
+				{@const description = groupDescription(g)}
 				<li class="group">
 					<div class="group__row">
 						<button class="group__name" onclick={() => expand(g)}>
@@ -254,7 +256,7 @@
 											>{t('groups.virtual_badge', 'System')}</span
 										>{/if}
 								</span>
-								{#if g.description}<span class="muted">{g.description}</span>{/if}
+								{#if description}<span class="muted">{description}</span>{/if}
 								{#if !g.is_virtual && g.member_count != null}
 									<span class="muted">{memberCountLabel(g.member_count)}</span>
 								{/if}