fix(login): address PR review feedback

- Use apiClient instead of raw fetch() in configApi.getPublicConfig
- Validate DEFAULT_LANGUAGE against supported codes on server startup
- Log warning instead of silently swallowing fetch errors in LoginPage
- Case-insensitive browser language matching in detectBrowserLanguage
- Guard against undefined navigator in detectBrowserLanguage
- Validate language code in setLanguageTransient before applying
- Import directly from TranslationContext instead of barrel index

client/src/store/settingsStore.ts

@@ -64,6 +64,8 @@ export const useSettingsStore = create<SettingsState>((set, get) => ({
   // Used for automatic detection (browser/server default) — only explicit user
   // choices via the UI should be persisted.
   setLanguageTransient: (lang: string) => {
+    const supported = ['de', 'en', 'es', 'fr', 'hu', 'nl', 'br', 'cs', 'pl', 'ru', 'zh', 'zh-TW', 'it', 'ar']
+    if (!supported.includes(lang)) return
     set((state) => ({ settings: { ...state.settings, language: lang } }))
   },