fix(i18n): every refusal the API answers is structured and said in the reader's language

~150 HTTPExceptions carried a hand-written English sentence as their detail,
shown verbatim under the Hungarian UI — in the blocking error dialog and on
every inline surface that printed HttpError.detail (sign-in, setup wizard,
change password, the passphrase gate, live search). Four also quoted an
upstream exception's text back to the user.

- app/refusal.py: `refused(status, reason, **params)` → {code: "refused",
  reason, …params}; localizeDetail translates errors.refused.<reason> with the
  params interpolated. "Unknown X" 404s use the existing not_found(what).
- sysconfig.set_value raises InvalidSetting (reason + bounds) instead of an
  English ValueError; the three writers answer it through setting_refused.
- The Plex connection/write/image failures log what the upstream said and
  answer a reason; the search scraper's failure is logged and answered as
  youtube/unavailable (it crashed refusal_reason before).
- HttpError.detail now only ever holds a translated reason: a string detail
  (only the framework's own can remain) is left out, so reading .detail is
  safe everywhere — including destructured, the hole the raw-detail source
  scan could not see. That scan and its five-file exception list are gone.
- Enforced: test_http_details.py fails on any HTTPException with a sentence
  for a detail; the contract test requires every refused reason and every
  not_found "what" in both languages, and no key for one that is gone.
- local/jsx-comment-text: a // inside JSX children renders as text; the rule
  is ten lines in eslint.config.js rather than eslint-plugin-react's ~1800
  lockfile lines.

frontend/src/i18n/backendIds.contract.test.ts

@@ -105,6 +105,31 @@ const goneWhats = [
     ),
   ),
 ];
+// Every generic refusal → `errors.refused.<reason>`: each `refused(<status>, "<reason>")` anywhere in
+// the backend (not `_refused`, a router's own family), plus the values of the settings map, which
+// `setting_refused` picks from at runtime.
+const appSources = (dir = ""): string[] =>
+  readdirSync(new URL(`../../../backend/app/${dir}`, import.meta.url), {
+    withFileTypes: true,
+  }).flatMap((e) =>
+    e.isDirectory()
+      ? appSources(`${dir}${e.name}/`)
+      : e.name.endsWith(".py")
+        ? [backend(`${dir}${e.name}`)]
+        : [],
+  );
+const refusedReasons = [
+  ...new Set([
+    ...appSources().flatMap((src) =>
+      [...src.matchAll(/(?<![\w.])refused\(\s*\d+,\s*"(\w+)"/g)].map((m) => m[1]!),
+    ),
+    ...[
+      ...(backend("refusal.py").split("_SETTING_REASONS = {")[1]?.split("}")[0] ?? "").matchAll(
+        /:\s*"(\w+)"/g,
+      ),
+    ].map((m) => m[1]!),
+  ]),
+];
 // A refused YouTube action → `errors.youtube.<reason>`, the reasons read from their Literal.
 const youtubeReasons = [
   ...(
@@ -134,6 +159,9 @@ describe("backend ids have their names in both languages", () => {
     expect(failDetails).toEqual(expect.arrayContaining(["facebook.login_wall"]));
     expect(goneWhats).toEqual(expect.arrayContaining(["playlist", "download", "job"]));
     expect(youtubeReasons).toEqual(["quota", "reconnect", "unavailable"]);
+    expect(refusedReasons).toEqual(
+      expect.arrayContaining(["weak_password", "setting_too_low", "plex_write_failed"]),
+    );
     // Every code the frontend localizes is raised somewhere the scan can see.
     expect(adminCodes.filter((c) => !adminRefusals.some((m) => m[1] === c))).toEqual([]);
   });
@@ -200,6 +228,13 @@ describe("backend ids have their names in both languages", () => {
       ).toEqual([]);
     });
 
+    it(`${lang}: every generic refusal the backend can answer, and none it cannot`, () => {
+      expect(missing(refusedReasons.map((r) => `errors.refused.${r}`))).toEqual([]);
+      expect(
+        [...idsUnder(keys, "errors.refused")].filter((r) => !refusedReasons.includes(r)),
+      ).toEqual([]);
+    });
+
     it(`${lang}: every admin refusal reason`, () => {
       expect(missing(adminReasons.map((r) => `errors.admin.${r}`))).toEqual([]);
       expect([...idsUnder(keys, "errors.admin")].filter((r) => !adminReasons.includes(r))).toEqual(