fix(i18n): stop the backend from inventing Chinese display labels in response data fields

[argszero]

Summary

The client translates the backend's error field (ui/js/api.js hands it to I18n.mapErr(), wordlist in ui/js/i18n.js) — #249 covered that path and its gate. Response data fields have no such path: the UI renders them raw. So a backend that invents a Chinese display label and puts it in a data field prints Chinese on the en interface, and cargo test stays green. This PR removes the two reachable cases and adds one contract per direction.

Reachable leaks (both measured, not read off the code):

backend origin	render site	trigger
src/routes/admin.rs — department bucket COALESCE(d.name, '（未分配）')	barRow(d.name, …) → #usage-dept	any user with dept_id IS NULL + usage this month
src/gateway.rs — plan name derived from type (API（按量） …)	#sf-plan options / share toast / share-table cell	always — none of the 6 [[plans]] in config.example.toml set name

Both fire next to a localization mechanism that already exists on the same screen/payload — the member table on that very admin page uses T("common.unassigned"), and showPlanHint already maps pl.type through share.plan.* — so this is a missed call site, not a missing feature.

Related Issue

None — found by scanning, not reported.

Changes

• src/routes/admin.rs: the no-department bucket returns '', the same shape as the neighbouring users[].dept_name (COALESCE(d.name, '')).
• src/gateway.rs: /api/plans returns p.name verbatim (empty when config leaves it unset); docstring rewritten; existing test updated.
• ui/js/app.js: planLabel(pl) — config's own name when set, else a wordlist key per type (share.planName.paygo|token|coding, 3 new keys, packs now 809). Used by the dropdown, the share toast and the share-table cell. The department bucket renders d.name || T("common.unassigned") (existing key, zero new ones).
• ui/js/app.js: the Plan dropdown is rebuilt when its data source changes (dataset.plansSrc) instead of once (dataset.init), and the cascading fills read the source at call time. The view renders before loadSharing() resolves, so the fallback table always built the dropdown first and the one-shot guard kept it for good — the backend half was invisible on that control.
• ui/index.html cache-bust; ui/README.md documents the rule and a same-axis item deliberately left out.
• No config/data-structure change.

Tests

• cargo test — 275 passed / 0 failed
• cargo fmt --check — clean (clippy: only the pre-existing false collapsible_match at src/protocol.rs:662)
• New tests:

i18n_pack::backend_data_fields_are_language_neutral — scans every src/**/*.rs, extracts Chinese literals delivered through a json! data field (key ≠ error), including through a local let binding (the plan-name fallback was written that way — without that layer the gate is green on the pre-change tree) and skipping nested json! and #[cfg(test)] modules. The result must be exactly the adjudicated exemption list — a new invented label turns it red, a stale exemption turns it red too. The roster carries a deliberate budget of one, because it is a sunset list rather than a registry: the tempting "keep inventing, register the label" fix has to edit a second place to pass.

i18n_pack::backend_neutral_data_labels_are_localized_in_the_client — both render sites must have the localized fallback (a neutral backend without one just yields a blank label), and the dropdown must be rebuilt from source evidence rather than a one-shot flag.

routes::tests::usage_department_bucket_without_a_department_is_language_neutral — the runtime contract: with a dept_id IS NULL user who has usage this month, the bucket name carries no CJK, and a real department name still passes through verbatim.

Scanner geometry helpers (enclosing_fn_span, local_binding_rhs, cjk_literals, statement_containing) have their own self-proof test that injects labels in several literal forms and asserts the extractor's output contains the marker — an extractor that silently finds nothing is the failure mode this guards.

A/B

Rust, full cargo test per leg, mutated in place and restored against HEAD (md5 + git diff --stat + diff checks):

leg	red set
L1_gateway (plan-name fallback restored)	{backend_data_fields_are_language_neutral}
L2_admin (SQL bucket restored)	{usage_department_bucket_without_a_department_is_language_neutral}
L3_client (client fallback removed)	{backend_neutral_data_labels_are_localized_in_the_client} + 2 key-count gates (collateral)
L4_roster_escape (competing fix: keep the invented name and register it in the roster)	{backend_data_fields_are_language_neutral}
working tree	{}

JS (tmp/c2133_probe.js; jsdom, real index.html + the 4 real scripts, only fetch stubbed, atp_lang=en forced; each check compared against its expectation, so the pre-change leg's demonstration checks are not mistaken for acceptance failures; every leg generated by string substitution from the working tree):

leg	mismatched checks
working tree	{} — 17/17
pre-change tree (client + payloads from origin/main)	{B2b,D1,D2,E2,F1,F2}
render sites read pl.name raw	{A2b,D2}
dropdown keeps the one-shot guard	{F1,F2}
dropdown reads a source snapshot taken at first render	{B2b,D2}
no-department bucket loses its localized fallback	{D1,E2}

F1/F2 (the provider list must follow the live plan source) are what make the rebuild half observable at all — without them that leg reads green, which is how the one-shot guard survived the first pass.

Checklist

• Branch named fix/…
• Conventional Commits (fix(i18n): …, test(i18n): …)
• Single responsibility, minimal change — one axis: invented display labels in response data fields

Deliberately not bundled

ui/js/data.js carries its own PLANS[].name display labels (API（按量）, Kimi Code 会员…), which the client shows when /api/plans fails. Different producer (a client data table, not a response field), and it needs a brand-vs-generic ruling first. provLabel() right beside it is the pattern to copy (I18n.lang === "zh" gates the label table, en gets the id). Recorded in ui/README.md and in the project ledger.