docs+i18n: sub-locale tour copy, OpenAPI disable-coach, runbook notes

- tourReplay + tourReplayHint native translations for es / fr / it / pl
- dragHandleHint trimmed in de + pl (sr-only, was ~30 words)
- layout-coach-fab docstring: Settings → Insights (matches URL + title)
- OpenAPI: GET + PATCH /api/auth/me/disable-coach
- Operations runbook: attemptNumber audit vs alert-signal semantics
- docs/ops/deploy.md: explicit migration-before-container ordering

Closes L1 + L3 + L4 + L6 + L9 + H4 in v1.4.48 backlog.

docs/api/openapi.yaml

@@ -306,6 +306,14 @@ components:
         - data
         - error
       type: object
+    DisableCoachRequest:
+      description: Per-account Coach opt-out toggle (v1.4.47 W3). `true` hides the Coach FAB and short-circuits its API gates.
+      properties:
+        disableCoach:
+          type: boolean
+      required:
+        - disableCoach
+      type: object
     ErrorEnvelope:
       additionalProperties: false
       description: "Standard error response: data is null, error is human prose."
@@ -394,6 +402,29 @@ components:
         - data
         - error
       type: object
+    GetDisableCoachResponse:
+      additionalProperties: false
+      properties:
+        data:
+          additionalProperties: false
+          properties:
+            disableCoach:
+              type: boolean
+          required:
+            - disableCoach
+          type: object
+        error:
+          type: "null"
+        meta:
+          additionalProperties: false
+          properties:
+            requestId:
+              type: string
+          type: object
+      required:
+        - data
+        - error
+      type: object
     GetSourcePriorityResponse:
       additionalProperties: false
       properties:
@@ -1051,6 +1082,29 @@ components:
         - data
         - error
       type: object
+    PatchDisableCoachResponse:
+      additionalProperties: false
+      properties:
+        data:
+          additionalProperties: false
+          properties:
+            disableCoach:
+              type: boolean
+          required:
+            - disableCoach
+          type: object
+        error:
+          type: "null"
+        meta:
+          additionalProperties: false
+          properties:
+            requestId:
+              type: string
+          type: object
+      required:
+        - data
+        - error
+      type: object
     PutCoachPrefsResponse:
       additionalProperties: false
       properties:
@@ -1921,6 +1975,45 @@ paths:
       summary: Replace per-user Coach prompt-tuning preferences
       tags:
         - Auth
+  /api/auth/me/disable-coach:
+    get:
+      description: Returns the user's per-account Coach opt-out flag. Default `false` (Coach visible). Powers the Settings →
+        Insights "Hide Coach" Switch and the layout FAB short-circuit.
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/GetDisableCoachResponse"
+          description: Resolved flag.
+        "401": *a1
+        "422": *a2
+        "429": *a3
+      summary: Read per-user Coach opt-out flag
+      tags:
+        - Auth
+    patch:
+      description: Flips the per-account Coach opt-out flag. Idempotent — the DB write fires even when the value matches so
+        the audit-log row mirrors the API call. Rate-limit 60/min per user.
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DisableCoachRequest"
+        required: true
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/PatchDisableCoachResponse"
+          description: Resolved next-state echoed back for optimistic-update consumers.
+        "401": *a1
+        "422": *a2
+        "429": *a3
+      summary: Toggle per-user Coach opt-out flag
+      tags:
+        - Auth
   /api/auth/me/source-priority:
     get:
       description: Returns the per-metric-class source priority used by the analytics aggregator. Missing keys fall back to