fix(i18n): every refusal the API answers is structured and said in the reader's language

~150 HTTPExceptions carried a hand-written English sentence as their detail,
shown verbatim under the Hungarian UI — in the blocking error dialog and on
every inline surface that printed HttpError.detail (sign-in, setup wizard,
change password, the passphrase gate, live search). Four also quoted an
upstream exception's text back to the user.

- app/refusal.py: `refused(status, reason, **params)` → {code: "refused",
  reason, …params}; localizeDetail translates errors.refused.<reason> with the
  params interpolated. "Unknown X" 404s use the existing not_found(what).
- sysconfig.set_value raises InvalidSetting (reason + bounds) instead of an
  English ValueError; the three writers answer it through setting_refused.
- The Plex connection/write/image failures log what the upstream said and
  answer a reason; the search scraper's failure is logged and answered as
  youtube/unavailable (it crashed refusal_reason before).
- HttpError.detail now only ever holds a translated reason: a string detail
  (only the framework's own can remain) is left out, so reading .detail is
  safe everywhere — including destructured, the hole the raw-detail source
  scan could not see. That scan and its five-file exception list are gone.
- Enforced: test_http_details.py fails on any HTTPException with a sentence
  for a detail; the contract test requires every refused reason and every
  not_found "what" in both languages, and no key for one that is gone.
- local/jsx-comment-text: a // inside JSX children renders as text; the rule
  is ten lines in eslint.config.js rather than eslint-plugin-react's ~1800
  lockfile lines.

frontend/src/lib/actionErrors.ts

@@ -9,11 +9,13 @@ const GATEWAY = new Set([502, 503, 504]);
 /**
  * WHY a write failed, in the reader's language — the line under the toast's title.
  *
- * A STRUCTURED server detail (`{code, reason}`) wins: `req` has already run it through
+ * The server's own reason wins: `req` has already run the structured detail through
  * `localizeDetail`, and it is the most specific thing there is to say (quota numbers, which row is
- * gone). A plain-string `detail` never does — it is whatever English the route hand-wrote, and
- * `reportFailure` leaves exactly 403/404/429 to the caller, so those used to put "No user with that
- * email." into a Hungarian UI (deep-review round 5). Otherwise the status says it.
+ * gone). Every refusal the app answers is structured now (backend `app/refusal.py`), and a string
+ * detail never reaches `HttpError.detail` (see there) — the hand-written English that once put
+ * "No user with that email." into a Hungarian UI has nowhere left to come from. `detailData` still
+ * gates it: status-0 errors carry a local sentinel in `detail`, not a reason. Otherwise the status
+ * says it.
  */
 export function failureReason(err: unknown): string {
   const t = i18n.t.bind(i18n);