i18n Phase 3b — web URL routing, legal MDX, SEO hreflang, email locale, full sweep

Follow-up to Phase 3 — web (next-intl) (PR #147, merged to develop). Phase 3 shipped only the cookie-driven locale core (middleware locale detection in detect→auth→redirect order, next-intl request config loading the shared catalogs, LocalePicker + provider, set-locale server action). It deliberately deferred the riskier/larger pieces below rather than restructure live marketing routes in an unsupervised run.

Deferred web work to complete i18n on web:

1. URL-prefixed [locale] marketing routes — restructure app/[locale]/(marketing)/... so marketing renders at / (en) and /fr/.... Compose with the existing (already locale-aware) apps/web/middleware.ts; keep /app/* cookie-driven (no prefix). Verify auth redirects for /fr/login.
2. French legal MDX — parallel fr/ MDX legal pages under app/[locale]/(legal)/.
3. SEO — sitemap.ts + robots.ts emit hreflang + per-locale marketing URLs; per-locale OG/metadata titles/descriptions.
4. Email locale — every nodemailer send site reads the recipient's profiles.locale before render.
5. Full web string sweep — replace remaining hardcoded user-facing strings with t('ns.key'), grouped by namespace; run pnpm i18n:translate for FR; spot-check the marketing namespace.

Builds on (already merged): Phase 1 shared foundation, Phase 2 profiles.locale + PATCH /api/me/locale, Phase 3 cookie core. Touches apps/web/middleware.ts (risky path) → will need human review, won't auto-merge.

Sibling deferrals tracked elsewhere: mobile push-notification localization (no send pipeline yet); extension deep components (SaveToOption, CommentThread) still English — see those tasks' comments.