i18n Phase 3 — web (next-intl)

Split from the master i18n plan (task i18n-en, Plane YOPSYS-62).

BLOCKED ON: Phase 1 foundation (i18n-en) + Phase 2 DB/preference. Promote backlog → todo once BOTH have merged. Independent of Phase 4 (mobile) and Phase 5 (extension) — runs in parallel with them.

Scope (~6–10h):

• Install next-intl; configure i18n/request.ts to load shared catalogs from @pickism/shared.
• Compose next-intl middleware with existing apps/web/middleware.ts — ORDER MATTERS: locale detection → auth → redirect. Verify auth redirects still work for /fr/login (MEDIUM risk).
• Routes: app/[locale]/(marketing)/... URL-prefixed for marketing; app/app/... stays cookie-driven. Resolution: URL → NEXT_LOCALE cookie → profiles.locale → Accept-Language → 'en'.
• MDX legal pages: parallel fr/ files under app/[locale]/(legal)/.
• Locale picker in marketing nav + /app settings (writes cookie + DB via the Phase 2 endpoint when logged in); server actions sync DB ↔ cookie.
• Email (nodemailer): every send site reads recipient profiles.locale before render (MEDIUM risk — many send sites).
• sitemap.ts/robots.ts hreflang + per-locale marketing URLs; per-locale OG/metadata.
• Phase-6 string extraction FOR WEB belongs here: sweep web components, replace hardcoded strings with t('ns.key'), run pnpm i18n:translate.