fix(server): resolve zh-TW default language, close lint gap on bracket env access

server/src/app-config/derive.ts

@@ -54,7 +54,11 @@ export function deriveApp(raw: RawEnv) {
 
 function resolveDefaultLanguage(raw: string | undefined): string {
   const lang = raw?.toLowerCase() || 'en';
-  return SUPPORTED_LANGUAGE_CODES.includes(lang) ? lang : 'en';
+  // Case-insensitive match resolved to the CANONICAL code (zh-TW, not zh-tw).
+  // The legacy lowercase-only `includes` could never match zh-TW and silently
+  // fell back to English for a supported language — deliberate fix.
+  const canonical = SUPPORTED_LANGUAGE_CODES.find((c) => c.toLowerCase() === lang);
+  return canonical ?? 'en';
 }
 
 export function deriveHttp(raw: RawEnv) {

server/src/app-config/env.schema.ts

@@ -62,7 +62,8 @@ export const envSchema = z.object({
   APP_VERSION: anyString,
   APP_URL: url,
   ALLOWED_ORIGINS: anyString,
-  DEFAULT_LANGUAGE: oneOf([...SUPPORTED_LANGUAGE_CODES]),
+  // Candidates lowercased so mixed-case codes (zh-TW) validate case-insensitively.
+  DEFAULT_LANGUAGE: oneOf(SUPPORTED_LANGUAGE_CODES.map((c) => c.toLowerCase())),
 
   // Security / session
   ENCRYPTION_KEY: anyString,

server/src/nest/app-config/tokens.ts

@@ -10,6 +10,13 @@
  *
  * Consumption pattern:
  *   constructor(@Inject(httpConfig.KEY) private readonly http: ConfigType<typeof httpConfig>) {}
+ *
+ * NOTE: today only httpConfig has a DI consumer (bootstrap.ts threads it into
+ * the pre-init middleware); the migrated call sites otherwise read through
+ * readEnv() because they live in classes whose unit tests instantiate them
+ * directly. The full token set is provisioned deliberately — it is the
+ * sanctioned pattern for NEW Nest consumers of boot-stable config, not dead
+ * scaffolding to prune.
  */
 import { registerAs } from '@nestjs/config';
 import {