fix(i18n): serve English for an unreadable catalog, refuse to boot without it

The server reads messages/<locale>.json from disk on first use. A missing
or corrupt file threw, and since the matchers iterate every locale, one bad
non-English catalog turned every request that touched them into a 500.
That locale is now served the English catalog, and the failure is logged
once as i18n.catalog.fallback with the locale and the reason. English is
the fallback itself: a process whose messages/en.json is missing or does
not parse refuses to start, with the file and the reason in the message.

The image build checks the catalogs twice with
scripts/verify-message-catalogs.mjs: in the builder against the locale
list in the source, and in the runner stage against the copies the image
carries.

Dockerfile

@@ -60,6 +60,11 @@ RUN node -p "require('/app/node_modules/pdfjs-dist/package.json').version" \
 # The same for @napi-rs/canvas, whose native binary must match its JS loader.
 RUN node -p "require('/app/node_modules/@napi-rs/canvas/package.json').version" \
       > /app/.canvas-version
+# Every shipped locale's message catalog is present and parses, checked
+# against the locale list in the source; the list is written out so the runner
+# stage can check the catalogs the image actually carries.
+RUN node scripts/verify-message-catalogs.mjs --dir messages \
+      --config src/lib/i18n/config.ts --write /app/.message-locales
 
 # ── Stage 3: Production runner ─────────────────────────────
 FROM node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2 AS runner
@@ -111,6 +116,12 @@ COPY --from=builder /app/public ./public
 # The server reads its message catalogs from here on first use, one locale at
 # a time (src/lib/i18n/server-catalogs.ts); they are not bundled.
 COPY --from=builder /app/messages ./messages
+# A missing or broken catalog is only noticed when a page asks for that
+# locale, so check the copies in this stage against the builder's list.
+COPY --from=builder /app/.message-locales /app/scripts/verify-message-catalogs.mjs /tmp/catalog-check/
+RUN node /tmp/catalog-check/verify-message-catalogs.mjs --dir /app/messages \
+      --locales /tmp/catalog-check/.message-locales && \
+    rm -rf /tmp/catalog-check
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 # Next's standalone output must carry the externalized worker dependencies.