v4.0.0rc2

Third release candidate for 4.0.

Translations are now one msg() lookup over a flat catalogue. catalog() registers a module's messages, msg("a.key") reads them, and every locale falls back to English. This is the breaking change module authors have to act on. LocaleState, use_locale(), get_current_locale_state() and resolve_locale_state() are gone; use pysepal.i18n.current_locale() and set_locale(). MapApp no longer accepts locale_state=, and only MapApp.element(...) builds a language selector. A placeholder must be named and plain, so {a.b}, {a[0]}, {a!r} and {a:spec} are refused when the catalogue binds, and pysepal.message.ms is removed. Plurals follow each locale's CLDR rules. Section 6 of the migration guide covers the move.

An AOI selection is serializable now. Every AoiResult carries an AoiSpec, AoiView restores from one, and the pickers seed from a value set outside them, so an app can save what the user chose and put it back on the next visit. Two demo apps show it: solara_aoi_app locally, and solara_aoi_gee_app on a SEPAL session, where the round-trip also covers a GEE asset and a drawn geometry.

Every AOI method now refuses ambient Earth Engine credentials in a per-connection runtime. process_draw, process_shape, process_points and process_asset went straight to init_ee(), which binds the process-global ee to whatever the container holds -- the platform service account in an app launcher. They take a gee_interface and inherit the topology guard, so a session-less caller is refused while the global ee is still unbound.

Asset exports can set a pyramiding policy.

Fixes: the Solara server assets are merged once per process rather than on every connection; a theme is released with its kernel and a SepalMap unobserves it on close; a dev-auth session is scoped per connection; the map paints its void in its own theme rather than Leaflet's grey; the map no longer zooms out past a world that fills the viewport; and a prepended field icon sits inside the field it belongs to.

ee-client now floors at 3.2.1, where the assets cache stops returning None for ten seconds after a cancelled fetch. Below it, a second click on the asset selector's reload raised.