fix(web): localize macOS native picker prompts via session locale (#228)

[hyoshi]

Summary

Localizes the macOS native folder/file picker prompts in the configure UI (#228). The prompts were hardcoded English AppleScript constants; they now come from a locale-keyed catalog (en/ja) selected by the server-side session locale — the zero-injection design is unchanged.

Design

• mureo/web/native_picker.py: _MACOS_DIR_SCRIPT / _MACOS_FILE_SCRIPT become _MACOS_DIR_SCRIPTS / _MACOS_FILE_SCRIPTS dicts keyed "en" / "ja". Every prompt stays a hardcoded constant — no client value is ever interpolated into the AppleScript. pick_directory / pick_file gain a keyword-only locale: str = "en"; unknown locales fall back to en.
• mureo/web/handlers.py: _post_pick_directory / _post_pick_file forward locale=self.wizard.session.locale. The session locale is only settable through POST /api/locale with an {"en","ja"} allow-list, so the value is provably never client text.
• Non-darwin (tkinter) path is unchanged: it keeps showing the localized client title, which already worked.

Security

The injection posture is unchanged and re-pinned by tests: the osascript -e body is byte-identical per locale regardless of the client title, a hostile title never reaches argv on darwin, and a locale field smuggled into the request body cannot override the session locale (tested on both routes).

Test plan

• tests/test_web_native_picker.py — TestMacOSLocaleKeyedPrompts (en default, ja prompts for dir/file, unknown-locale fallback, constant-per-locale body, hostile-title re-check under ja, catalog key set) + TestLocaleKwargNonDarwin
• tests/test_web_handlers.py — locale forwarding on both pick routes + body-smuggling negative tests
• 187 tests pass across the two files; ruff + black clean
• CI green on the PR

Closes #228