feat: multi-language interface (zh-CN/zh-TW/en/ja), multilingual offline changelog, settings robustness

i18n
- shared/i18n: dependency-free t() with flat per-namespace dictionaries
  (common/settings/workspace/terminal/ssh/panels/main), zh-CN fallback
- language picker in Settings -> System; antd ConfigProvider locale follows it
- main process tracks the language too: tray menu, close prompt, ssh/sftp/
  zmodem errors and the log TUI marker are translated; tray rebuilds on change

changelog
- CHANGELOG.md (zh-CN canonical) + .zh-TW/.en/.ja, bundled via ?raw and read
  per interface language with per-version fallback to zh-CN (no network)
- sync-changelog.cjs merges RELEASE_NOTES[.<lang>].md per release; release.cjs
  refuses to publish without a zh-CN entry for the version

settings robustness
- closeAction 'ask' survives the sanitizer (was silently coerced to 'tray',
  which made the 'ask every time' option dead)
- highlight rules are repaired instead of dropped: string priority, 0/1
  enabled, missing fg colour; unknown fields preserved
- load-time warnings are written to settings-warnings.log (deduped, capped)

terminal/UI
- configurable terminal toolbar: open working directory (default on), session
  log recording (off), open logs folder (off)
- global shortcut field records key combos (modifier or F-key required)
- input suggestions + command history default to off, with a one-time reset
  migration for existing installs
- settings dialog scrolling fixed (antd v6 renamed the tabs container), theme
  gallery nested scrollbar removed, joined segmented pickers with readable
  selected-state text

tests: settings-store.mjs (15 checks) added; commands-store.mjs updated for
the new off-by-default history setting

tests/commands-store.mjs

@@ -49,6 +49,20 @@ const store = new commandsMod.CommandsStore(userData, async (p) => {
 })
 
 // ---- 3. History record / dedupe / cap ------------------------------------------
+// Recording is off by default (the setting ships disabled); every test below that
+// exercises recording enables it explicitly through this helper. A call site that
+// passes `historyEnabled: false` still wins, because the spread comes last.
+const writeSettings = (terminal) =>
+  writeFileSync(
+    join(userData, 'settings.json'),
+    JSON.stringify({ terminal: { historyEnabled: true, ...terminal }, system: {} }),
+    'utf8'
+  )
+const DEFAULT_LIMIT = 100
+// The settings file has to exist before the first recordCommand: with no file,
+// the store falls back to the shipped defaults, where recording is off.
+writeSettings({})
+
 store.recordCommand('  echo hello  ')     // trims to 'echo hello'
 store.recordCommand('ls -la')
 store.recordCommand('ps aux')
@@ -82,9 +96,6 @@ store.clearHistory()
 ok(store.listHistory().length === 0, 'clearHistory empties history')
 
 // ---- 3b. History limit + the recording switch -----------------------------------
-const writeSettings = (terminal) =>
-  writeFileSync(join(userData, 'settings.json'), JSON.stringify({ terminal, system: {} }), 'utf8')
-const DEFAULT_LIMIT = 100
 
 // The bundled default raises past the old hard cap of 500 only when configured;
 // out of the box the list is trimmed to the default limit.