hub v0.118.0: the household's e-mails follow the household's language (R-558 Part A)

The hub has written every customer e-mail in Hungarian whatever the box was set
to. The box has published its language since controller v0.247.0; nothing read
it. Now it does.

Nothing an operator reads changes. The Hungarian mails are byte-identical, and
that is a diff rather than a reading: 56 goldens per language captured from
v0.117.0 BEFORE any string moved, and all 56 Hungarian ones pass unchanged after
every sentence was routed through the new bundle.

- internal/i18n: flat bundle, 79 keys, hu authoritative + hu fallback, ceiling 0.
- customerMessages/severityLabels are DERIVED from the bundle, so a sentence is
  written in one place and all 40+ tests that read those maps still work.
- Language order: last reported -> created-with -> hu. reports.language defaults
  to EMPTY, never hu: "never told us" is not "chose Hungarian".
- message_customer on POST /api/v1/event, additive and optional forever, for the
  sentences the box composes and the hub cannot translate.
- The bind page is per-language, and its `expired` state stays Hungarian: it is
  the state an unknown token lands in, so rendering a real English customer's
  token in English would make the LANGUAGE answer what the TEXT refuses to.

Two defects found inside the release:
- R-581: the newest report was picked by received_at, which has SECOND
  granularity, so same-second reports tied and the winner was arbitrary. Ordered
  by the autoincrement id now. GetCustomers() still has the shape - row open.
- R-582: the English copy-guard stems, ported word for word from Hungarian,
  convicted 141 honest sentences. The English claim is a phrase with a modal.

R-555 closed: the language allowlist entry is out of wire_contract_gate.py.
hub_copy_gate.py follows the sentences into the bundle - without that it would
have scanned four files that no longer hold any customer text and reported
success. Three new decoys incl. an innocent control.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/web/selfbind_test.go

@@ -21,8 +21,8 @@ import (
 
 const (
 	testPass    = "alpha beta gamma delta epsilon" // the customer retrieval passphrase (5 words)
-	testCode    = "ABC234"                          // an appliance console pairing code (raw stored form)
-	testCodeFmt = "abc-234"                         // as a human might type it (lowercased, separated)
+	testCode    = "ABC234"                         // an appliance console pairing code (raw stored form)
+	testCodeFmt = "abc-234"                        // as a human might type it (lowercased, separated)
 )
 
 // selfBindSetup seeds a customer (with passphrase + email) and one registered appliance carrying the
@@ -123,8 +123,8 @@ func TestSelfBind_B_NoOracle(t *testing.T) {
 	selfBindSetup(t, st, "acme", testCode)
 	selfBindSetup(t, st, "acme2", "XYZ789")
 
-	t1 := mintLink(t, st, "acme", selfBindTTL)   // wrong-code attempt (right passphrase)
-	t2 := mintLink(t, st, "acme2", selfBindTTL)  // wrong-passphrase attempt (right code)
+	t1 := mintLink(t, st, "acme", selfBindTTL)  // wrong-code attempt (right passphrase)
+	t2 := mintLink(t, st, "acme2", selfBindTTL) // wrong-passphrase attempt (right code)
 	wrongCode := strings.ReplaceAll(bindPOST(t, s, t1, "ZZZ999", testPass).Body.String(), t1, "TOKEN")
 	wrongPass := strings.ReplaceAll(bindPOST(t, s, t2, "xyz-789", "wrong words here now").Body.String(), t2, "TOKEN")