3.4.2 — audit hardening

Floxum audit hardening. Removed an unused RuntimeException import, locale-aware number formatting (dropped hardcoded en-US), and wired the sidebar card titles + quick-action labels through the translator. Two LOW findings (the app.routes wrapping and the openComposer DOM/rAF shim) are intentionally retained with documented rationale.