Sync locale catalogs and wire GDPR settings to authenticated APIs

[yosemite01]

Summary

#889 — Keep locale catalogs structurally synchronized

• Added scripts/check-locale-parity.mjs (npm run check:locales, wired into reusable-test.yml) which fails CI when a locale under src/i18n/locales is missing keys present in en.json (the source of truth). Extra keys (e.g. Russian's CLDR _one/_few/_many plural forms) are reported as warnings only, since those are legitimate additions, not drift.
• Fixed the drift the check found: added the missing app.footer.tagline key to ar, de, fr, hi, pt, zh, and the missing base/_plural keys for time.*, offline.queue.description, offline.status.queueStatus, and payment.rateLimit.requestsAvailable in ru.json (using the existing Russian "many" plural form, which was already correctly translated under a different key).
• Fixed product-name leakage: every locale catalog (including en.json) referenced the placeholder brand "Wata-Board" (and, in Arabic, its transliteration "واتا-بورد") instead of "PetChain". Replaced all 50 occurrences across all 10 locales.
• t() in src/i18n/index.tsx now logs a de-duplicated, dev-only console warning whenever it falls back to English for a key missing in the active locale, so future gaps surface during development instead of silently degrading.

#886 — Complete GDPR settings integration with authenticated APIs

• src/lib/gdpr.ts previously called fetch() directly against /api/gdpr/*, which proxied to the backend (src/pages/api/gdpr/*) without forwarding any auth token or cookies — any request could read/mutate GDPR data for an arbitrary userId. Rewrote it as an axios-based client following the same pattern already used by twoFactorAPI/userAPI (bearer token interceptor reading from localStorage, withCredentials: true), hitting the backend directly. Removed the now-unused, insecure proxy routes under src/pages/api/gdpr/.
• useGdpr now also fetches and stores deletion-request status on load, so a pending/processing erasure request is correctly reflected after a page reload instead of resetting.
• Added a single pendingAction state to useGdpr so export / request-deletion / cancel-deletion can't be double-submitted while one is already in flight, and added cancelDeletion.
• GdprSettings now surfaces the current erasure-request status (pending/processing/completed/failed/cancelled) and swaps the "Request Account Erasure" button for a "Cancel Erasure Request" action while a request is active, rather than only ever offering a fresh request.
• Error messages now distinguish 401 (session expired) and 403 (forbidden) from generic failures.

TODO / not fully covered

• No automated tests were added (out of scope per maintainer instruction for this pass — pragmatic/fast fix only).
• Backend route shapes for the GDPR endpoints (/gdpr/users/:userId/...) are inferred from the previous Next.js proxy routes; adjust src/lib/gdpr.ts if the real backend contract differs.
• hi.json and a few other locales still contain literal English copy in places beyond the brand-name fix (pre-existing translation-quality gap, not structural — out of scope here).

Test plan

• node scripts/check-locale-parity.mjs exits 0 with no missing keys across all locales.
• All locale JSON files parse successfully.
• Manual verification against a running backend (not done — no build/install per task scope).

Closes #889
Closes #886

[drips-wave]

@yosemite01 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits