feat(i18n): LocaleController switcher with open-redirect protection (closes #73)
- App\Controllers\LocaleController: GET /locale?set=xx&return=/path
- Sets 1-year cookie (HttpOnly=false for SSR, SameSite=Lax, Secure on HTTPS)
- 302 redirect to explicit return URL > Referer > /
- Pure buildResponse() helper for unit tests (no headers/exit)
- current() helper: resolves locale from $_GET/$_COOKIE/Accept-Language
- safeRedirect: rejects absolute URLs, protocol-relative (//evil.com),
backslash tricks (\\evil.com), javascript:/data: schemes
- 28 PHPUnit tests (LocaleControllerTest), all green
- Total project tests now: 92
ce21242308