feat(email): write to people in their own language (E9.5 S7)

Twelve mails carried hardcoded English while the app itself has enforced HU/EN parity since E5.
A mail is the one user-facing surface nobody can re-render by switching the UI language: it arrives
once, in whatever language we picked, and stays that way. That made the epic's own headline mail —
"one mail, one click" — English for a Hungarian reader.

The text moved to a catalog (`mailtext.py`) with a `text(key, lang, **vars)` renderer, and the parity
rule is now a test rather than a habit: every key must carry both languages AND the same
`{placeholders}`. A translation that drops `{link}` sends a mail with no link in it; one that invents
a placeholder raises inside a background task nobody is watching. Both are silent in production.

Every `send_*` takes the language as its second argument, resolved by the REQUEST handler and never
inside the mail — these all run as background tasks, after the request's session is gone, which is
the same reason the approval mail computes its link in the handler.

Where the language comes from, in order: the account's own preference; failing that, the language the
person asked us in; failing that, English. The middle one is new — `invites.lang`, migration `0082` —
because the mails an access request produces go to an address that usually has no account yet, and
the signal does exist: the page their form was submitted from, or the locale Google reported for a
sign-in we refused. Captured rather than derived, for the third time in this epic (`google_email` in
S3, `preferences.language` in S6 taught the same lesson): a signal that exists only in one moment
cannot be backfilled later. So the admin is asked in exactly one place — the invitation to an address
they typed in themselves, where nobody has ever told us anything.

That send is now a dialog rather than a bare click, which is also where the "you already wrote to
them" warning belongs — it used to live only in a tooltip the admin may never hover, guarding the one
action whose failure mode is mailing a real person twice.

S6's registration `lang` field turned out to be dead on arrival: the backend accepted it, the
frontend never sent it, so every account has been storing nothing. The request builders now stamp the
UI language themselves — a signal that has to be passed in by every caller is one every caller can
forget, which is exactly how it shipped unset.

Admins are notified one mail per language group instead of one blast to everyone. They are people
with their own UI language; a single message would have to pick one of them and be wrong for the rest.

Also removes a duplicated `invited_at` column declaration on `Invite` (two identical definitions
landed in S6).

frontend/src/components/AdminUsers.tsx

@@ -28,6 +28,8 @@ import { ADMIN_USERS_TAB_KEY } from "../lib/adminUsersTab";
 import Tooltip from "./Tooltip";
 import InlineNotice from "./InlineNotice";
 import { Section } from "./ui/form";
+import SegmentedToggle from "./SegmentedToggle";
+import { LANGUAGES, type LangCode } from "../i18n";
 import { LoadingState, StateMessage } from "./QueryState";
 import { useConfirm } from "./ConfirmProvider";
 import Tabs, { usePersistedTab } from "./Tabs";
@@ -458,10 +460,39 @@ function PendingAccessRowView({
   );
 }
 
+/** The mail language for one invitation. Owns its own display state and reports every change up
+ *  through `onPick`, because the dialog that hosts it resolves to a plain boolean — the choice has
+ *  to live in the caller's closure, not in this component. Endonyms come from the app's own
+ *  language list, so a third locale would appear here for free. */
+function InviteLangPicker({
+  initial,
+  onPick,
+}: {
+  initial: LangCode;
+  onPick: (lang: LangCode) => void;
+}) {
+  const { t } = useTranslation();
+  const [lang, setLang] = useState<LangCode>(initial);
+  return (
+    <SegmentedToggle
+      className="mt-3"
+      size="md"
+      ariaLabel={t("settings.invites.inviteLang")}
+      label={t("settings.invites.inviteLang")}
+      options={LANGUAGES.map((l) => ({ value: l.code, label: l.label }))}
+      value={lang}
+      onChange={(v) => {
+        setLang(v);
+        onPick(v);
+      }}
+    />
+  );
+}
+
 // --- Access requests (the Invite whitelist) — moved verbatim from Settings → Account -------
 
 function AdminInvites() {
-  const { t } = useTranslation();
+  const { t, i18n } = useTranslation();
   const qc = useQueryClient();
   const confirm = useConfirm();
   const me = useMe();
@@ -540,10 +571,10 @@ function AdminInvites() {
   // nudging someone who never asked. `invited_at` comes back on the row so a second click is a
   // decision rather than an accident.
   const invite = useMutation({
-    mutationFn: (i: Invite) => api.sendInvitation(i.id),
-    onSuccess: (_r, i) => {
+    mutationFn: (v: { inv: Invite; lang: LangCode }) => api.sendInvitation(v.inv.id, v.lang),
+    onSuccess: (_r, v) => {
       refresh();
-      notify({ level: "success", message: t("settings.invites.invited", { email: i.email }) });
+      notify({ level: "success", message: t("settings.invites.invited", { email: v.inv.email }) });
     },
     onError: (err) =>
       notify({
@@ -554,6 +585,33 @@ function AdminInvites() {
             : t("settings.invites.inviteFailed"),
       }),
   });
+  // The one recipient the app has no language signal about: the admin typed this address in, so
+  // nobody ever told us how to write to its owner. The dialog is where that gets decided — and it
+  // is also where the "you already wrote to them" warning belongs, next to the button that would
+  // do it a second time, rather than only in a tooltip the admin may never hover.
+  const onInvite = async (inv: Invite) => {
+    let lang: LangCode = LANGUAGES.some((l) => l.code === inv.lang)
+      ? (inv.lang as LangCode)
+      : ((i18n.language.split("-")[0] === "hu" ? "hu" : "en") as LangCode);
+    const ok = await confirm({
+      title: t("settings.invites.inviteTitle"),
+      message: (
+        <>
+          <p>
+            {t(
+              inv.invited_at
+                ? "settings.invites.inviteConfirmAgain"
+                : "settings.invites.inviteConfirm",
+              { email: inv.email, time: new Date(inv.invited_at ?? 0).toLocaleString() },
+            )}
+          </p>
+          <InviteLangPicker initial={lang} onPick={(v) => (lang = v)} />
+        </>
+      ),
+      confirmLabel: t("settings.invites.inviteSend"),
+    });
+    if (ok) invite.mutate({ inv, lang });
+  };
 
   const add = useMutation({
     mutationFn: (email: string) => api.addInvite(email),
@@ -647,7 +705,7 @@ function AdminInvites() {
                     }
                   >
                     <button
-                      onClick={() => invite.mutate(i)}
+                      onClick={() => onInvite(i)}
                       disabled={invite.isPending}
                       className={`shrink-0 p-1 rounded-md disabled:opacity-50 transition ${
                         i.invited_at

frontend/src/components/adminInvites.dom.test.tsx

@@ -24,7 +24,12 @@ vi.mock("react-i18next", async (importOriginal) => {
   };
 });
 
-type ConfirmOpts = { title?: string; message?: string; confirmLabel?: string; danger?: boolean };
+type ConfirmOpts = {
+  title?: string;
+  message?: React.ReactNode;
+  confirmLabel?: string;
+  danger?: boolean;
+};
 const confirmMock = vi.fn(async (_opts: ConfirmOpts) => true);
 vi.mock("./ConfirmProvider", () => ({
   useConfirm: () => confirmMock,
@@ -64,7 +69,7 @@ vi.mock("../lib/api", async (importOriginal) => {
       ...actual.api,
       adminInvites: () => listMock(),
       deleteInvite: (id: number) => deleteMock(id),
-      sendInvitation: (id: number) => inviteMock(id),
+      sendInvitation: (id: number, lang: string) => inviteMock(id, lang),
       // The access tab also renders the stuck-sign-ups section (E9.5 S5); nothing stuck here, so it
       // renders nothing and this file stays about the delete affordance.
       adminPendingAccess: () => Promise.resolve([]),
@@ -86,6 +91,7 @@ const invite = (over: Partial<Record<string, unknown>> = {}) => ({
   has_account: false,
   still_allowed_by_env: false,
   invited_at: null,
+  lang: null,
   ...over,
 });
 
@@ -247,12 +253,65 @@ describe("inviting someone the admin whitelisted", () => {
 
     fireEvent.click(screen.getByLabelText("settings.invites.inviteLabel:asker@example.com"));
 
-    await waitFor(() => expect(inviteMock).toHaveBeenCalledWith(1));
+    // Falls back to the admin's own UI language: nobody ever told us anything about this mailbox.
+    await waitFor(() => expect(inviteMock).toHaveBeenCalledWith(1, "en"));
     expect(notifyMock).toHaveBeenCalledWith(
       expect.objectContaining({ message: "settings.invites.invited:asker@example.com" }),
     );
   });
 
+  it("asks first, and writes to nobody when the admin backs out", async () => {
+    confirmMock.mockResolvedValue(false);
+    listMock.mockResolvedValue([invite({ status: "approved" })]);
+    await open();
+
+    fireEvent.click(screen.getByLabelText("settings.invites.inviteLabel:asker@example.com"));
+
+    await waitFor(() => expect(confirmMock).toHaveBeenCalledTimes(1));
+    expect(inviteMock).not.toHaveBeenCalled();
+  });
+
+  it("defaults to the language this person asked us in", async () => {
+    listMock.mockResolvedValue([invite({ status: "approved", lang: "hu" })]);
+    await open();
+
+    fireEvent.click(screen.getByLabelText("settings.invites.inviteLabel:asker@example.com"));
+
+    await waitFor(() => expect(inviteMock).toHaveBeenCalledWith(1, "hu"));
+  });
+
+  it("sends in the language picked in the dialog, not the default", async () => {
+    // The dialog is the only place this decision can be made — and the pick has to survive back to
+    // the caller, because the confirmation resolves to a plain boolean.
+    let release: (ok: boolean) => void = () => {};
+    confirmMock.mockImplementation(() => new Promise<boolean>((r) => (release = r)));
+    listMock.mockResolvedValue([invite({ status: "approved" })]);
+    await open();
+
+    fireEvent.click(screen.getByLabelText("settings.invites.inviteLabel:asker@example.com"));
+    await waitFor(() => expect(confirmMock).toHaveBeenCalled());
+    const dialog = render(<>{confirmMock.mock.calls[0]![0].message}</>);
+    fireEvent.click(dialog.getByText("Magyar"));
+    release(true);
+
+    await waitFor(() => expect(inviteMock).toHaveBeenCalledWith(1, "hu"));
+  });
+
+  it("warns in the dialog when this person has already been written to", async () => {
+    // The warning used to live only in a tooltip, which the admin may never hover. It belongs next
+    // to the button that would mail a real person a second time.
+    listMock.mockResolvedValue([
+      invite({ status: "approved", invited_at: "2026-09-05T09:00:00Z" }),
+    ]);
+    await open();
+
+    fireEvent.click(screen.getByLabelText("settings.invites.inviteLabel:asker@example.com"));
+
+    await waitFor(() => expect(confirmMock).toHaveBeenCalled());
+    const dialog = render(<>{confirmMock.mock.calls[0]![0].message}</>);
+    expect(dialog.container.textContent).toContain("settings.invites.inviteConfirmAgain");
+  });
+
   it("offers none on a denied row, which would contradict the decision", async () => {
     listMock.mockResolvedValue([invite({ status: "denied" })]);
     await open();

frontend/src/i18n/locales/en/settings.json

@@ -163,6 +163,11 @@
     "invited": "Invitation sent to {{email}}.",
     "inviteFailed": "Couldn't send that invitation.",
     "inviteEmailOff": "No mail was sent: this instance has no working SMTP setup. Check Configuration → Email.",
+    "inviteTitle": "Send invitation?",
+    "inviteConfirm": "Email {{email}} to say their address is whitelisted and Siftlode is open for them.",
+    "inviteConfirmAgain": "You already invited {{email}} on {{time}}. Sending now writes to them a second time.",
+    "inviteSend": "Send",
+    "inviteLang": "Mail language",
     "addFailed": "Couldn't add that email",
     "requested": "requested {{time}}",
     "approveHint": "Approve — whitelist this email and email them they're in.",

frontend/src/i18n/locales/hu/settings.json

@@ -163,6 +163,11 @@
     "invited": "Meghívó elküldve ide: {{email}}.",
     "inviteFailed": "Nem sikerült elküldeni a meghívót.",
     "inviteEmailOff": "Nem ment ki levél: ezen a példányon nincs működő SMTP. Nézd meg a Beállítások → E-mail részt.",
+    "inviteTitle": "Küldesz meghívót?",
+    "inviteConfirm": "Levél megy a(z) {{email}} címre arról, hogy a címe engedélyezve van, és nyitva áll előtte a Siftlode.",
+    "inviteConfirmAgain": "Ezt a címet már meghívtad ekkor: {{time}} ({{email}}). Ha most küldesz, másodszor is írsz neki.",
+    "inviteSend": "Küldés",
+    "inviteLang": "A levél nyelve",
     "addFailed": "Nem sikerült hozzáadni ezt az e-mailt",
     "requested": "kérve: {{time}}",
     "approveHint": "Jóváhagyás — fehérlistára teszi ezt az e-mailt és e-mailben értesíti őket, hogy bekerültek.",

frontend/src/lib/api/admin.ts

@@ -29,6 +29,10 @@ export interface Invite {
    *  is deliberately silent — it opens a door rather than knocking — so telling them is a separate
    *  act, and this is how the admin sees they have already done it. */
   invited_at: string | null;
+  /** The language this person asked us in, or null when nobody ever told us — a row the admin
+   *  whitelisted by hand. The invitation dialog preselects it and falls back to the admin's own UI
+   *  language, so the guess is visible and correctable before anything is sent. */
+  lang: string | null;
 }
 
 /** A sign-up that is still outside, as the admin screen shows it. Same shape as a user row plus the
@@ -199,8 +203,12 @@ export const adminApi = {
   denyInvite: (id: number) => req(`/api/admin/invites/${id}/deny`, { method: "POST" }),
   // Tell someone their address is whitelisted. Never automatic: adding the address stays silent, so
   // this is the deliberate act that actually reaches a person.
-  sendInvitation: (id: number): Promise<Invite> =>
-    req(`/api/admin/invites/${id}/invite`, { method: "POST" }, { quiet: true }),
+  sendInvitation: (id: number, lang: string): Promise<Invite> =>
+    req(
+      `/api/admin/invites/${id}/invite`,
+      { method: "POST", body: JSON.stringify({ lang }) },
+      { quiet: true },
+    ),
   addInvite: (email: string) =>
     req("/api/admin/invites", { method: "POST", body: JSON.stringify({ email }) }),
   /** `still_allowed_by_env` is true when the address stays allow-listed by the server's env

frontend/src/lib/api/auth.ts

@@ -1,7 +1,7 @@
 // The sign-in funnel: public auth config, email+password register/login/reset, email verification,
 // session management, access requests, and the hidden demo login. Errors on the interactive paths
 // are surfaced inline (quiet) rather than via the global modal. Only touches core's req.
-import { req } from "./core";
+import { req, uiLang } from "./core";
 
 /** Why password sign-in refused. The three account-shaped reasons name the mailbox and both gates,
  * so the card can render an honest state instead of a red line; `invalid` and `rate_limited` answer
@@ -61,10 +61,13 @@ export const authApi = {
   }> => req("/auth/config"),
 
   // --- email + password (errors handled inline via quiet) ---
+  // `lang` is stamped here rather than passed in: this is the ONE moment the sign-up language
+  // exists anywhere the server can see it (the account does not exist yet to carry it), and every
+  // mail this person ever gets is written from what lands here.
   register: (email: string, password: string): Promise<{ status: string }> =>
     req(
       "/auth/register",
-      { method: "POST", body: JSON.stringify({ email, password }) },
+      { method: "POST", body: JSON.stringify({ email, password, lang: uiLang() }) },
       { quiet: true },
     ),
   // A refusal carries a structured `{code:"login", reason, …}` detail — see LoginBlocked above.
@@ -125,8 +128,13 @@ export const authApi = {
     ),
 
   // --- onboarding: access requests + demo entry ---
+  // Same reasoning as register: the requester has no account to carry a language preference, so the
+  // page they asked from is what decides the language of the approval or denial mail.
   requestAccess: (email: string): Promise<{ status: string }> =>
-    req("/auth/request-access", { method: "POST", body: JSON.stringify({ email }) }),
+    req("/auth/request-access", {
+      method: "POST",
+      body: JSON.stringify({ email, lang: uiLang() }),
+    }),
   // Hidden demo entry: a whitelisted email logs into the shared demo account, no Google
   // sign-in. Returns whether a session was established.
   demoLogin: (email: string): Promise<{ authenticated: boolean }> =>

frontend/src/lib/api/core.ts

@@ -8,6 +8,12 @@ import { formatBytes } from "../format";
 import { reportError } from "../errorDialog";
 import { activeAccountId, ACTIVE_ACCOUNT_KEY, notifyActiveAccountChange } from "../activeAccount";
 
+/** The active UI language, as a bare code the server understands ("en"/"hu" — never "en-GB").
+ *  Lives here so the request builders can stamp it themselves: a signal that has to be passed in by
+ *  every caller is one every caller can forget, which is how the registration language shipped as a
+ *  field nobody ever filled (E9.5 S6 → S7). */
+export const uiLang = (): string => i18n.language.split("-")[0] || "en";
+
 export class HttpError extends Error {
   status: number;
   detail?: string; // server-provided reason (FastAPI's `detail`), when present

frontend/src/lib/api/setup.ts

@@ -1,7 +1,7 @@
 // First-run install wizard: probes install state and drives admin/config/email setup with the
 // one-time token printed to the container logs (carried via setupHeaders). Every write is quiet so
 // the wizard renders errors inline. Only touches core's req + setupHeaders.
-import { req, setupHeaders } from "./core";
+import { req, setupHeaders, uiLang } from "./core";
 
 export const setupApi = {
   setupStatus: (): Promise<{ configured: boolean }> => req("/api/setup/status"),
@@ -22,7 +22,11 @@ export const setupApi = {
   setupTestEmail: (token: string, to: string): Promise<{ ok: boolean }> =>
     req(
       "/api/setup/test-email",
-      { method: "POST", headers: setupHeaders(token), body: JSON.stringify({ to }) },
+      {
+        method: "POST",
+        headers: setupHeaders(token),
+        body: JSON.stringify({ to, lang: uiLang() }),
+      },
       { quiet: true },
     ),
   setupFinish: (token: string): Promise<{ ok: boolean }> =>