perf(i18n,shell): ship one locale and stop blocking the first paint

The client bundle carries only the active locale — resolved on the
server and handed to the provider with no hydration flash, halving the
dashboard route to under a megabyte parsed (288 KiB gzip). The auth
shell renders the app chrome immediately instead of a spinner while the
session resolves in parallel, the widgets request folds into the
snapshot it duplicated, and insight pills prefetch their sub-pages —
a first visit to a sub-page lands in about ninety milliseconds instead
of nearly a second.

docs/api/openapi.yaml

@@ -1735,6 +1735,31 @@ paths:
         "401": *a1
         "422": *a3
         "429": *a4
+  /api/measurements/restore:
+    post:
+      tags:
+        - Measurements
+      summary: Restore soft-deleted measurements
+      description: Un-tombstones up to 200 of the caller's soft-deleted measurement rows in one call — the delete-Undo
+        counterpart to `/api/measurements/bulk-delete`. Idempotent via the `Idempotency-Key` header; rate-limited
+        `measurements:restore:<userId>`. Forged / foreign / not-deleted ids are silently skipped — `restored` is the
+        count of rows actually un-tombstoned. The restored rows re-surface in `/api/sync/changes` as upserts.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/MeasurementsRestoreRequest"
+      responses:
+        "200":
+          description: Restore processed.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/MeasurementsRestoreResponse"
+        "401": *a1
+        "422": *a3
+        "429": *a4
   /api/sleep/night:
     get:
       tags:
@@ -4229,6 +4254,20 @@ components:
       required:
         - ids
       description: 1..200 measurement ids, scoped to the caller. Forged / foreign ids are silently skipped (no existence leak).
+    MeasurementsRestoreRequest:
+      type: object
+      properties:
+        ids:
+          minItems: 1
+          maxItems: 200
+          type: array
+          items:
+            type: string
+            minLength: 1
+      required:
+        - ids
+      description: 1..200 measurement ids, scoped to the caller. Forged / foreign / not-deleted ids are silently skipped (no
+        existence leak).
     DeviceRegisterRequest:
       type: object
       properties:
@@ -7323,6 +7362,33 @@ components:
       required:
         - deleted
       additionalProperties: false
+    MeasurementsRestoreResponse:
+      type: object
+      properties:
+        data:
+          $ref: "#/components/schemas/MeasurementsRestoreResult"
+        error:
+          type: "null"
+        meta:
+          type: object
+          properties:
+            requestId:
+              type: string
+          additionalProperties: false
+      required:
+        - data
+        - error
+      additionalProperties: false
+    MeasurementsRestoreResult:
+      type: object
+      properties:
+        restored:
+          type: integer
+          minimum: 0
+          maximum: 9007199254740991
+      required:
+        - restored
+      additionalProperties: false
     SleepNightResponse:
       type: object
       properties: