feat(i18n): #16 Phase 3 — localize emails + in-app notifications (recipient language)

[WolfTasks]

Summary

Final phase of backend-i18n #16: async/clientless backend text — emails and in-app notification titles (plus the 2 templated notification bodies) — now render in the recipient's stored language (user.language), with English fallback. Completes the #16 rollout (Phases 1–2 already on main).

3 TDD commits, one per task (+ 1 CI fix, see below):

1. bb270c2 — 11 new catalog keys (email.* / notification.*) in en (messages.properties) + de (messages_de.properties, \uXXXX-escaped, 0 non-ASCII bytes) + EmailNotificationMessagesTest.
2. 54e1ed8 — EmailService renders mention/assigned subject + body via localeOf(recipient); new/merged EmailServiceTest.
3. 30b5aca — NotificationService: localize the 2 listener titles; convert createDirect to a keyed signature that looks up user.language and renders internally (injects LocalizedMessages + UserRepository, EN fallback). Migrates all 3 callers + their tests in one atomic (compile-breaking) commit. IncidentService now uses the human issue.key (not the raw UUID) in title/body/link, via a single guarded IssueRepository lookup.

Design decisions (from the approved spec)

• Recipient locale, not request locale — rendered via LocalizedMessages.get(key, locale, args) with locale = localeOf(recipientUser); never LocaleContextHolder (the triggering request may be a different language than the recipient).
• 2 hard-coded template bodies localized too (Incident, SLA) — otherwise a German title would pair with an English body. Genuine user-content bodies (comment excerpt, issue title, automation message) stay untranslated.
• Numeric SLA arg passed as .toString() (avoids MessageFormat digit-grouping: 1440, not 1.440). Keys append-only; LocalizedMessages unchanged; no DB migration.

CI fix bundled in (commit 98a4c55)

The first backend-docker run failed the Trivy HIGH/CRITICAL image gate on CVE-2026-54291 (org.postgresql:postgresql 42.7.11), a HIGH-severity CVE disclosed after main last passed CI — unrelated to the i18n changes (main would hit the same failure on its next run). Fixed by bumping the JDBC driver to the patched 42.7.12 via an extra["postgresql.version"] override of the Spring Boot 3.5.16 BOM (same idiom as the existing commons-lang3 / logback overrides) and regenerating the Gradle lockfile pin. Re-run CI is fully green.

Verification

• Full backend suite 382/382 green, including the 3 CI gates: MessagesParityTest, KeyedReferenceIntegrityTest, NoUnkeyedUserFacingThrowTest (forced rerun of gates + all 6 new/changed test classes = BUILD SUCCESSFUL).
• messages_de.properties: 0 non-ASCII bytes (all German \uXXXX-escaped); en/de key-set parity holds.
• Per-task reviews + final whole-branch review (opus): 0 Critical, 0 Important. Three Minor items are optional test-coverage niceties over paths already exercised elsewhere (deferred, non-blocking).
• All CI checks green after the postgresql fix (incl. backend-docker / Trivy gate).

Frontend / behavior note

IncidentService incident notifications now link to /issues/{issueKey} (e.g. /issues/WOLF-1) and show the issue key instead of a raw UUID — aligns with every other notification, which already used issue.key.

Owed after merge (Wolfgang)

Manual DE/EN smoke (trigger a mention/assignment email + an incident/SLA/automation notification for a de user and an en user; confirm recipient-language subject/title + localized incident/SLA bodies; confirm user-content bodies stay untranslated), then the v1.0.x release — which ships all of #16 (Phases 1–3).

🤖 Generated with Claude Code

[WolfTasks]

✅ CI is green now. The earlier backend-docker failure was the Trivy HIGH/CRITICAL image gate tripping on CVE-2026-54291 (org.postgresql:postgresql 42.7.11) — a HIGH-severity CVE disclosed after main last passed CI, unrelated to the i18n changes. Fixed in 98a4c55 by bumping the JDBC driver to the patched 42.7.12 (BOM property override + lockfile regen). On the re-run all gating checks pass, including backend-docker / Trivy and backend-test.