Localizza errori API, sistema layout mobile e documenta allineamento iOS.

Gli header Accept-Language dalle app e i fix di padding/menu sul web chiudono il giro password-policy; il doc guida il lavoro su Mac.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/controllers/application_controller.rb

@@ -1,17 +1,25 @@
 class ApplicationController < ActionController::API
   include ActionController::HttpAuthentication::Token::ControllerMethods
 
+  before_action :set_api_locale
   before_action :authenticate_request!
 
   attr_reader :current_user
 
   private
 
+  def set_api_locale
+    explicit = LocaleResolver.normalize(request.headers["X-Locale"])
+    I18n.locale = explicit ||
+                  LocaleResolver.from_accept_language(request.headers["Accept-Language"]) ||
+                  I18n.default_locale
+  end
+
   def authenticate_request!
     token = bearer_token
     payload = JsonWebToken.decode(token)
     @current_user = User.find_by(id: payload[:user_id]) if payload
-    render json: { error: "Unauthorized" }, status: :unauthorized unless @current_user
+    render json: { error: I18n.t("flash.sessions.unauthorized") }, status: :unauthorized unless @current_user
   end
 
   def bearer_token