feat: catalog browser polish + design system refresh + translation pipeline

- catalog: P5 restriction selector flow (mainGroupsPath), grid/tree/columns view modes for brands and models with persisted user settings
- translations: bulk translateMany() path with 1d cache-miss TTL, expanded automotive dictionary; categories.service now drives EN→TR via TranslationsService instead of mapper-side strings
- pcat: migrate auth from v1 JWT to v3 widget tokens (TWS- api-key + supporting X-* headers, IP-bound via DataImpulse proxy)
- pl24: new fetchP5Restrictions() for restriction-level navigation
- subscriptions: trial extended 7 → 30 days
- design: oklch color tokens, brand semantic color, Geist + Instrument Serif fonts, tinted shadows, button "brand" variant with hover-lift, accessible focus rings, skip link, 404 NotFound page, auth layout polish
- nginx: dynamic resolver for Faro upstream
- config: OPENROUTER_API_KEY env (used by emex translate bootstrap script)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker/nginx/sites/sase.tr.conf

@@ -30,9 +30,11 @@ server {
 
     # Faro telemetry proxy → Grafana Cloud (avoids CORS)
     location /collect/ {
-        proxy_pass https://faro-collector-prod-eu-west-2.grafana.net/collect/;
+        resolver 1.1.1.1 8.8.8.8 valid=300s ipv6=off;
+        set $faro_upstream "faro-collector-prod-eu-west-2.grafana.net";
+        proxy_pass https://$faro_upstream/collect/;
         proxy_http_version 1.1;
-        proxy_set_header Host faro-collector-prod-eu-west-2.grafana.net;
+        proxy_set_header Host $faro_upstream;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_ssl_server_name on;