feat(translator-tools): add locale review and glossary workflow

docs/ARCHITECTURE.md

@@ -1,9 +1,16 @@
 # Architecture
 
-Text Tools is a static React/Vite application wrapped in the shared Toolbox shell. `text/pipeline.ts` defines an ordered, typed list of transformations. `applyPipeline` starts from the exact source, applies enabled steps one at a time, checks expansion after every step, and returns the last successful output with per-step before/after counts and warnings.
+Translator Tools is a static React/Vite application wrapped in the shared Toolbox shell.
 
-Text encoding/decoding, line-ending conversion, bounded CSV parsing and Unicode-aware case primitives come from `@add-ideas/toolbox-helpers`. File decoding uses an explicit encoding and fatal-or-replacement choice; it does not guess a charset. Inverse JSON/HTML/URL/Base64/hex stages are strict: malformed syntax and non-UTF-8 byte output fail the step rather than being silently repaired. Column selection offers a quoted CSV mode that preserves embedded delimiters/newlines and a separate literal-delimiter-per-line mode. Recipe JSON carries a schema/app identity, accepts at most 100 supported steps, discards supplied IDs and assigns local monotonic IDs.
+The workbench parses a single imported locale file in-browser, normalizes either:
 
-`text/evidence.ts` inspects original bytes before decoding, including BOM, exact UTF-8 validity/first invalid offset, zero-byte parity and CR/LF/CRLF counts. Artifact export emits the selected output bytes and a deterministic evidence document containing canonical-source and exact-output SHA-256 values, inventories, recipe and step reports. The document records that direct Toolbox handoff is unavailable in this release; the SDK 0.3.0 transfer contract is intentionally not activated until the Portal consumer rollout is coordinated.
+- i18next-like language maps (`{ "en": {...}, "de": {...} }`)
+- single-locale objects (`{ "key": "value" }`, or JS-style assignment forms like `const de = {...}`).
 
-Version 0.2 operations are synchronous and bounded, so the app creates no worker and has no persistence or server API. Relative entry and asset URLs keep the build relocatable below a nested portal path.
+Strings are flattened into stable dot paths for review/editing and can be serialized
+back with an inverse unflattening step. Suggestions come from local glossary entries
+and are matched by language pair and fuzzy string distance.
+
+No background workers are required today. Persistent state is limited to a local
+Storage glossary cache; everything else remains in process memory until download or
+transfer.

docs/PRIVACY-SECURITY.md

@@ -1,9 +1,16 @@
 # Privacy and security
 
-Source text, imported files, recipes and results stay in page memory. There is no telemetry, analytics, account, persistence or runtime network path. Imported text is rendered as text/preformatted content, not executable HTML; HTML escaping produces a string and does not preview it as markup.
+Locale files and generated outputs stay in-browser and are not uploaded.
 
-Files are rejected above 16 MiB before reading. Decoded/pasted pipeline input is limited to 2,000,000 UTF-16 units, recipe text to 1,000,000 units/100 steps, and output to both 8× the original (with a small-input floor) and 32 MiB. Quoted CSV selection additionally limits rows, columns and field size. Strict inverse stages reject malformed escapes/encodings and invalid UTF-8; they do not attempt permissive repair. These limits reduce accidental expansion but do not prove that output is safe for a downstream interpreter.
+No accounts, telemetry or runtime network requests are used for the core workflow.
+The app stores glossary terms in local browser storage so they are available on the same
+device for repeated reviews.
 
-Compatibility normalisation, case conversion, transliteration, whitespace/line transforms, column selection and narrow encodings can change or lose information. Locale sorting depends on the browser's `Intl.Collator`. The exact source, output, per-step counts and warnings remain visible so users can review those changes before copying or downloading.
+Parser/serializer limits are bounded to prevent accidental expansion:
 
-Byte evidence does not guess an encoding or prove the selected decoder is correct. A valid UTF-8 byte sequence may represent text intended for another encoding, zero-byte parity is only a UTF-16 review signal, and replacement characters may already have existed in the source. Artifact evidence hashes canonical UTF-8 source text and exact exported bytes, clearly labels both, and includes filenames and transformation details that may themselves be sensitive.
+- Imports and exports are capped at 5 MiB each.
+- Large objects are flattened and rendered with per-session bounds.
+
+Suggested translations are purely local matching; they do not call external services.
+Transfers to the Portal are signed local handoffs only and never stored by a remote
+processor by default.