feat(07-01): add bcrypt, locale override, and validation rules

Co-authored-by: Cursor <cursoragent@cursor.com>

surf/locale_from_principal.go

@@ -0,0 +1,19 @@
+package surf
+
+import (
+	"net/http"
+
+	"git.golem15.com/golem15/summercms/bouncer"
+	"git.golem15.com/golem15/summercms/towel"
+)
+
+// LocaleFromPrincipal overrides the header locale with the authenticated
+// principal's PreferredLocale when that value is non-empty.
+func LocaleFromPrincipal(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if p, ok := bouncer.User(r.Context()); ok && p.PreferredLocale != "" {
+			r = r.WithContext(towel.WithLocale(r.Context(), p.PreferredLocale))
+		}
+		next.ServeHTTP(w, r)
+	})
+}