feat(10-02): backend strings, controller messages and declarative toolbar

- phrasebook ships the backend::lang admin strings (pl, en) with CLDR
  plural maps, loads them as namespace backend, applies
  pact.HasLangOverrides trees (lang/<locale>/<namespace>/<group>.yaml)
  after every namespace, and fails activation when a backend key cannot
  convert to plural forms
- Translator.Forms, Bundle, Resolved and Has serve keys as CLDR form maps
- Public GET /lang returns every backend::lang key for the request
  locale over the fallback locale, Cache-Control no-cache
- config_list, config_form and config_relation accept a strict messages
  block; omitted keys take framework defaults, schemas serve every message
  as CLDR forms, and activation fails on a missing phrase key
- toolbar.buttons is an ordered [create, delete] list; the Winter string
  form, duplicates, unknown actions and delete without showCheckboxes fail
  at boot, and create is dropped when the controller has no form
- Form schema serves the raw Winter redirects; scaffold emits the list
  syntax; form and relation schema routes are typed in the admin OpenAPI

cabana/http.go

@@ -96,6 +96,11 @@ func Activate(app *backpack.App, plugins []party.Plugin) (*Routes, error) {
 	if app == nil {
 		return nil, errors.New("cabana: app is nil")
 	}
+	if tr, ok := app.Lookup[*phrasebook.Translator](); ok && tr != nil {
+		if err := validateMessageKeys(reg, tr); err != nil {
+			return nil, err
+		}
+	}
 	guards, ok := app.Lookup[*bouncer.Registry]()
 	if !ok || guards == nil {
 		guards = bouncer.NewRegistry()
@@ -183,6 +188,10 @@ func (s *service) mount(r pact.Router) {
 		g.Post("/login", s.login, throttle)
 		g.Post("/refresh", requireAjax(s.refresh))
 	})
+	// The string bundle is public: the login screen needs it before auth.
+	r.GroupRaw(api, nil, func(g pact.Router) {
+		g.Get("/lang", s.langBundle)
+	})
 	r.GroupRaw(api, []string{"backend"}, func(g pact.Router) {
 		g.Post("/auth/logout", requireAjax(s.logout))
 		g.Get("/auth/me", s.me)