The dependency audit fails on every branch since GHSA-vfj7-8cjw-p6xm was
published: braces <= 3.0.3 can exhaust the stack on deeply nested brace
patterns. There is no fixed release; 3.0.3 is the latest version, and the
latest fast-glob and micromatch still depend on it.

braces is reached only through the lint toolchain (eslint-config-next >
@next/eslint-plugin-next > fast-glob > micromatch). It is not part of the
built or deployed application, and it only receives the glob patterns of
this repository.

The audit now ignores this one advisory by its identifier. Every other
advisory of high severity still fails the check, and the entry carries the
reason and the condition for removing it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Switch language in place and add Russian

The dependency audit reports a critical Next.js advisory for releases before
16.3.6 (remote code execution in next/og ImageResponse) and high-severity
denial-of-service advisories for brace-expansion before 5.0.12. The site does
not import next/og, but production runs the affected Next.js release.

- next and eslint-config-next: 16.3.3 to 16.3.8.
- brace-expansion: the lockfile resolves 1.1.21 within its range; the 5.x
  line, which minimatch pins to 5.0.9, is overridden to 5.0.12 in the
  workspace until minimatch depends on a fixed release.

pnpm audit reports no known vulnerabilities. Prettier, eslint, the type
check, the tests and the production build pass.

The language control no longer reloads the page. It calls a server action
that stores the preference cookie; Next.js then renders the current route
again and applies it in place, so scroll position, theme and client state
stay. The lang query parameter remains for links and for browsers without
script, and is the fallback when the action cannot reach the server. Both
paths write the cookie with the same attributes from one function.

The toggle button is now a language menu, a native select that lists each
language by its own name, and Russian (ru-RU) is the third locale with a
complete translation of every message.

Tests require every locale to have exactly the message shape of the default
locale with no empty text, and cover the cookie attributes and host
normalization. Verified locally: prettier, eslint, type check, tests, the
production build, and a browser run on the apex and ViGet hosts where the
language changed with no navigation and the scroll position kept.