lazyflat: combined alert + apply behind authenticated web UI

Three isolated services (alert scraper, apply HTTP worker, web UI+DB)
with argon2 auth, signed cookies, CSRF, rate-limited login, kill switch,
apply circuit breaker, audit log, and strict CSP.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apply/language.py

@@ -0,0 +1,19 @@
+import tomllib
+
+from settings import *
+from paths import *
+import logging
+
+logger = logging.getLogger("flat-apply")
+
+with open(TRANSLATIONS_FILE, "rb") as f:
+    TRANSLATIONS = tomllib.load(f)
+
+def get_text(message):
+    if message not in TRANSLATIONS.keys():
+        raise KeyError(f"{message} is not a valid translation.")
+    if LANGUAGE not in TRANSLATIONS[message].keys():
+        raise KeyError(f"there is no {LANGUAGE} translation for {message}.")
+    return TRANSLATIONS[message][LANGUAGE]
+
+_ = get_text