fix(cabana): safe account action URLs, per-section isolation and the prompted record action contract (B-WR-03, B-WR-05, B-WR-06)

- an account action URL is kept only when it is http(s) with a host or a
  same-origin path; anything else is dropped and logged without the URL
- a failing Status marks its section error: true and a failing Applies
  drops only that action, instead of a 500 for the whole list
- status text goes through localizeDetail (B-IN-03); the non-string
  payload refusal is the phrase key action_prompt_invalid (B-IN-02)
- the record action annotations and pact's prompt doc say what happens
  (B-IN-05 text); admin.json and schema.d.ts regenerated

admin/tests/fixtures/lang.json

@@ -228,6 +228,9 @@
     "backend::lang.extension.widget_failed": {
       "other": "Nie udało się wczytać tej kontrolki. Odśwież stronę, a jeśli błąd wróci, sprawdź zasoby wtyczki."
     },
+    "backend::lang.form.action_prompt_invalid": {
+      "other": "Odpowiedź musi być tekstem."
+    },
     "backend::lang.form.add": {
       "other": "Dodaj"
     },