feat(quick-261016-0fm): admin language follows the stored preference

- principalFrom sets PreferredLocale from metadata admin_locale; personal
  API token principals clear it, so token clients keep the request locale
- the guarded admin group runs locale.from-principal after the backend
  guard, overriding the LocaleResolver or Accept-Language locale
- GET /lang honours a supported ?locale= and reports meta.locales
  (cabana.LangEnvelope, cabana.LangMeta)
- Docker test for the override, refusals and /lang; docs and OpenAPI

admin/tests/fixtures/lang.json

@@ -827,6 +827,7 @@
     }
   },
   "meta": {
-    "locale": "pl"
+    "locale": "pl",
+    "locales": ["en", "pl"]
   }
 }

admin/tests/fixtures/typed.ts

@@ -30,7 +30,7 @@ import relationSchemaJson from './widgets.relation-schema.json'
 type S = components['schemas']
 type Rows = S['cabana.ListEnvelope-array_cabana_AdminRecord']
 
-export const langFixture: S['cabana.Envelope-cabana_LangBundle'] = langJson
+export const langFixture: S['cabana.LangEnvelope'] = langJson
 export const navigationFixture: S['cabana.Envelope-array_cabana_NavigationEntry'] = navigationJson
 export const settingsFixture: {
   list: S['cabana.Envelope-array_cabana_SettingsEntry']