v0.257.0: the app catalog can speak English (R-560, slice 5 Part A)

The READ PATH for a second language in `.felhom.yml`. An `i18n: {en: …}` sibling
block inside the same file; `Metadata.For(lang)` merges it FIELD BY FIELD over the
Hungarian, so a missing or blank English field shows the Hungarian one and a
half-translated app is a legal, shippable state.

`For("hu")` is the parsed struct with `I18n` cleared and nothing else — measured
against all 53 real catalog files, copied into `internal/stacks/testdata/catalog/`.
Lists replace whole; every other list is matched by its own key, never by position.
`For` never writes through the receiver: the metadata is the stack manager's, shared
by concurrent requests, and an in-place merge would leak one household's language
into another household's page.

Pages reach catalog copy only through `LocalizeStacks`/`LocalizeStackPtr`/`MetaFor`,
and `TestNoDirectMetaCopyReadOnPages` keeps a named, reasoned allow-list of every
direct `.Meta.<copy>` read in `internal/web` so the NEXT page to read one fails the
suite instead of quietly rendering Hungarian to an English household.

Eight red-proofs. Two of them convicted a hollow TEST rather than the code: a struct
copy shares its slices' backing arrays, so the obvious DeepEqual mutation check
passed a deliberately broken merge; and a one-entry fixture cannot tell key matching
from position matching. Both rewritten, both then seen to fail.

MinAgent: 0.131.0 (unchanged). Older controllers are unaffected — `LoadMetadata`
uses non-strict `yaml.Unmarshal`, so a pre-0.257.0 box drops the whole block.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/handlers.go

@@ -182,7 +182,11 @@ func (s *Server) dashboardHandler(w http.ResponseWriter, r *http.Request) {
 	data["TitleKey"] = "page.title.dashboard"        // i18n: the Hungarian title above is what hu renders
 	s.addRecoveryBanner(data, r)                     // R-241: the reminder bar, per visit
 	data["SettingsWarning"] = s.settings.LoadWarning // non-empty if settings.json was recovered from corruption
-	data["Stacks"] = deployedStacks
+	// R-560: the app rows carry catalog copy (each row's `.Meta.Description`), so the list the
+	// TEMPLATE sees is the localised view. The lists the warning helpers below see are the
+	// originals — they key on stack NAMES, and handing them a translated copy would only widen
+	// what a catalog push can reach. For hu this returns the same slice, untouched.
+	data["Stacks"] = stacks.LocalizeStacks(deployedStacks, s.langFor(r))
 	data["MissingStorage"] = s.missingStorageMap(deployedStacks)
 	data["OOMKilled"] = s.stackMgr.OOMKilledStacks()   // R-514
 	nw, ns := s.networkStorageWarnings(deployedStacks) // NAS unreachable (recoverable) / guest-side stub (defect)
@@ -362,7 +366,7 @@ func (s *Server) stacksHandler(w http.ResponseWriter, r *http.Request) {
 	data := s.baseData("stacks", "Alkalmazások")
 	data["TitleKey"] = "page.title.stacks" // i18n: the Hungarian title above is what hu renders
 	allStacks := visibleCatalogStacks(s.stackMgr.GetStacks())
-	data["Stacks"] = allStacks
+	data["Stacks"] = stacks.LocalizeStacks(allStacks, s.langFor(r)) // R-560 — see dashboardHandler
 	data["MissingStorage"] = s.missingStorageMap(allStacks)
 	nw, ns := s.networkStorageWarnings(allStacks) // NAS unreachable (recoverable) / guest-side stub (defect)
 	data["NetworkWarnings"] = nw
@@ -415,7 +419,7 @@ func (s *Server) logsHandler(w http.ResponseWriter, r *http.Request, name string
 
 	data := s.baseData("logs", stack.Meta.DisplayName+" — Naplók")
 	data["TitleKey"], data["TitleArgs"] = "page.title.logs", []interface{}{stack.Meta.DisplayName} // i18n: the Hungarian title above is what hu renders
-	data["Stack"] = stack
+	data["Stack"] = stacks.LocalizeStackPtr(stack, s.langFor(r))                                   // R-560
 	data["Logs"] = logs
 	s.executeTemplate(w, r, "logs", data)
 }
@@ -436,13 +440,23 @@ func (s *Server) deployHandler(w http.ResponseWriter, r *http.Request, name stri
 	stack, _ := s.stackMgr.GetStack(name)
 	alreadyDeployed := appCfg != nil && appCfg.Deployed
 
+	// R-560 — the ONE place this page's catalog copy is chosen, and it is placed here on purpose:
+	// every `meta` read below it (the field labels, the descriptions, the optional-config groups)
+	// is a display read, and this handler only ever renders — the deploy POST is a different
+	// route. The overlay changes copy fields ONLY; `env_var`, `type`, `generate`, `default`,
+	// `required` and `locked_after_deploy` are not in MetadataOverlay at all, so the auto-field
+	// map, the HDD_PATH question and the prefill keys below read exactly what they read before.
+	lang := s.langFor(r)
+	localized := meta.For(lang)
+	meta = &localized
+
 	pageTitle, pageTitleKey := meta.DisplayName+" — Telepítés", "page.title.deploy"
 	if alreadyDeployed {
 		pageTitle, pageTitleKey = meta.DisplayName+" — Beállítások", "page.title.app_settings"
 	}
 	data := s.baseData("deploy", pageTitle)
 	data["TitleKey"], data["TitleArgs"] = pageTitleKey, []interface{}{meta.DisplayName} // i18n: the Hungarian title above is what hu renders
-	data["Stack"] = stack
+	data["Stack"] = stacks.LocalizeStackPtr(stack, lang)                                // R-560
 	data["Meta"] = meta
 	data["AppConfig"] = appCfg
 	data["AlreadyDeployed"] = alreadyDeployed
@@ -583,7 +597,21 @@ func (s *Server) deployHandler(w http.ResponseWriter, r *http.Request, name stri
 		// App-to-app integrations
 		if im := s.integrationMgr.Load(); meta.HasIntegrations() && im != nil {
 			data["HasIntegrations"] = true
-			data["Integrations"] = im.ListForProvider(meta.Slug)
+			// R-560: the integration manager reads the stack's own (Hungarian) Meta to build these
+			// rows — it has no request and therefore no language. The label and the sentence are
+			// catalog copy, so they are re-taken from the LOCALISED meta here, matched by target
+			// the same way the overlay itself matches. Everything else in the row (state, target
+			// health, last error) is the manager's and is left alone.
+			rows := im.ListForProvider(meta.Slug)
+			for i := range rows {
+				for _, def := range meta.Integrations {
+					if def.Target == rows[i].Target {
+						rows[i].Label, rows[i].Description = def.Label, def.Description
+						break
+					}
+				}
+			}
+			data["Integrations"] = rows
 		}
 
 		// Geo-restriction per-app data
@@ -707,6 +735,13 @@ func (s *Server) appDetailHandler(w http.ResponseWriter, r *http.Request, slug s
 		}
 	}
 
+	// R-560 — this page is the one that shows ALL of an app's catalog copy (tagline, use cases,
+	// first steps, prerequisites, the default-credentials line, the data-folder labels), so the
+	// localised view is taken ONCE here and `found` is replaced by it. Everything downstream —
+	// the data-path cards, the initial-credentials note — then reads the household's language
+	// without a second decision to get wrong.
+	found = stacks.LocalizeStackPtr(found, s.langFor(r))
+
 	data := s.baseData("stacks", found.Meta.DisplayName)
 	data["Stack"] = found
 	data["Meta"] = found.Meta
@@ -743,7 +778,10 @@ func (s *Server) appDetailHandler(w http.ResponseWriter, r *http.Request, slug s
 			data["InitialCreds"] = &stacks.ExtractedCreds{
 				Available: creds.Available,
 				Username:  creds.Username,
-				Note:      creds.Note,
+				// R-560: the reader took the note from the manager's Hungarian metadata (it runs
+				// without a request and has no language). The note is catalog copy, so it is
+				// re-taken from the localised spec — the same value for hu, byte for byte.
+				Note: found.Meta.InitialCreds.Note,
 				// Password deliberately NOT carried — the reveal endpoint is the only path to it.
 			}
 			data["InitialCredsHasPassword"] = strings.TrimSpace(creds.Password) != ""