feat(10-02): backend strings, controller messages and declarative toolbar

- phrasebook ships the backend::lang admin strings (pl, en) with CLDR
  plural maps, loads them as namespace backend, applies
  pact.HasLangOverrides trees (lang/<locale>/<namespace>/<group>.yaml)
  after every namespace, and fails activation when a backend key cannot
  convert to plural forms
- Translator.Forms, Bundle, Resolved and Has serve keys as CLDR form maps
- Public GET /lang returns every backend::lang key for the request
  locale over the fallback locale, Cache-Control no-cache
- config_list, config_form and config_relation accept a strict messages
  block; omitted keys take framework defaults, schemas serve every message
  as CLDR forms, and activation fails on a missing phrase key
- toolbar.buttons is an ordered [create, delete] list; the Winter string
  form, duplicates, unknown actions and delete without showCheckboxes fail
  at boot, and create is dropped when the controller has no form
- Form schema serves the raw Winter redirects; scaffold emits the list
  syntax; form and relation schema routes are typed in the admin OpenAPI

cabana/phase09_contract_test.go

@@ -71,8 +71,9 @@ func TestPhase09ContractInventory(t *testing.T) {
 		if !ok200 && !ok201 {
 			t.Fatalf("%s has no 200 or 201 response", key)
 		}
-		if public[key] {
-			if _, ok := op.Responses["401"]; !ok {
+		if route.public {
+			// Login and refresh answer 401; the public string bundle does not.
+			if _, ok := op.Responses["401"]; public[key] && !ok {
 				t.Fatalf("%s has no 401 response", key)
 			}
 			continue