Add Hebrew and follow the browser language by default

Accept the unfixable braces advisory in the dependency audit

The dependency audit fails on every branch since GHSA-vfj7-8cjw-p6xm was
published: braces <= 3.0.3 can exhaust the stack on deeply nested brace
patterns. There is no fixed release; 3.0.3 is the latest version, and the
latest fast-glob and micromatch still depend on it.

braces is reached only through the lint toolchain (eslint-config-next >
@next/eslint-plugin-next > fast-glob > micromatch). It is not part of the
built or deployed application, and it only receives the glob patterns of
this repository.

The audit now ignores this one advisory by its identifier. Every other
advisory of high severity still fails the check, and the entry carries the
reason and the condition for removing it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

A second pass over the Hebrew text replaced words a Hebrew reader would
misread or that are not used for the concept:

- "native" was rendered with the word for "local"; it is now machine code
  for output and the Latin term for the native parts of the toolchain.
- Typed boundaries, the ecosystem, the dedicated account area and the
  first-party infrastructure use the usual terms instead of literal ones.
- The greetings and the new-visitor prompt no longer address one gender.

The text is still not reviewed by a native speaker.

The backend workflow now builds the API reference with DocFX and treats
every warning as an error, so an unresolved reference or a broken link
fails the check.

- docs/api holds the DocFX project: it reads apps/api/Progmaweb.Api.csproj
  and includes internal members, because the service is an application and
  most of its types are internal.
- .config/dotnet-tools.json pins docfx 2.81.0, so CI and a local run use the
  same version through `dotnet tool restore`.
- The workflow also runs when the DocFX project or the tool manifest change.
- `just api-docs` runs the same two commands locally.
- The generated site and metadata are ignored.

The gate does not require documentation comments: the API has none yet, and
DocFX does not report an undocumented member. Requiring them is a separate
change to the C# sources.

Verified locally with docfx 2.81.0 on the .NET 10 SDK: the build passes with
no warnings, and a broken link in the overview page makes it fail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Hebrew (he-IL) joins English, German and Russian with a complete message
tree and its own entry in the language menu.

A visitor who has not chosen a language now gets the language their browser
prefers. The Accept-Language header is negotiated by quality, only the
primary language is compared, and `iw` is accepted as the former code for
Hebrew. A browser that prefers no published language gets en-US, as before.
A language chosen in the menu is still stored in the cookie and always wins.

Hebrew does not mirror the page. The layout, the navigation and code keep
their left-to-right arrangement; only text follows the language. Blocks of
prose run right to left, short pieces such as links and buttons take the
direction of their own first letter, and inputs and code stay left to right.
The onward arrow points left in Hebrew, and a left-to-right mark keeps
"Visual X#" intact inside right-to-left text.

The Hebrew text was not reviewed by a native speaker.

Verified locally: node tests, type check, lint, prettier and a production
build; language selection per Accept-Language header against the dev server;
the Hebrew home and registration pages in a browser.

Switch language in place and add Russian