fix(dash0): the live demo's deep link, editing your own demo check, and the untranslated dashboard

[fclairamb]

Two specs from specs/todos/, plus the i18n leftovers they exposed.

The live demo's deep link (spec 2026-09-07-02-demo-deep-link-and-own-check-edit)

?demo=true was honoured only on an org-scoped login page, so the link that reads
naturally — solidping.io/dash0/login?demo=true — dropped the flag and landed on an
ordinary login form. It now works from all four entry points (/orgs/$org/login,
/login, /, /orgs/<any>) through one shared parseDemoFlag, and it outranks an
existing session: a visitor already signed into their own org re-enters the demo, and one
already in the demo is taken there without minting a second session.

Editing a check you created in the demo also works again. Every save issued a "replace the
notification bindings" PUT carrying exactly what was already stored; that route is closed
to the demo by design, so the no-op write was refused and took the whole edit down with
it — the rename went through, but the visitor saw a red refusal toast and stayed stuck on
the form. The write now fires only when the selection actually differs.

The audit on this one caught a real bug in the first pass: the escalation picker's
"No escalation (silent)" option POSTs a zero-step policy when the org owns none, so it
was not "just the allowlisted PATCH body" as the implementation claimed. That branch is
now withheld from demo sessions, and a blank-page regression on demo-disabled instances
was fixed alongside it. The server allowlist is unchanged —
TestEveryNonGETRouteIsClosedToADemoSession still passes as-is, which is the proof.

Untranslated strings and the demo refusal (spec 2026-09-07-02-untranslated-strings-...)

Five components rendered English inside otherwise-French pages. All are now wired to
en/fr/de/es. The demo write refusal is localized by error code rather than by
the server's English title, announced once (one toast.info, not a blue toast plus a red
banner plus a red toast depending on the page), and reworded so it is true for both the
route-level and the ownership refusal. The check edit route no longer lets a demo visitor
fill in a form the server will refuse — it shows the seeded-check note and a Clone button.

A new whole-tree locale key-parity test is the guard that stops the next component slipping
through; it immediately found and fixed pre-existing gaps in four other namespaces.

The leftovers that test then exposed

The specs' string tables were written from screenshots, so they missed strings in the same
components. Followed up: the check form's last two labels, the whole publications panel,
and the status-page incident editor — which was almost entirely English. The publication
state badge printed its raw enum value in every language; state and severity labels now
come from one lib/publication-labels.ts helper shared by both screens, so a picker and the
badge beside it cannot disagree, with a humanizing fallback so a value from a newer server
renders readably instead of leaking a translation key.

Known gap, deliberately not fixed here

QueryErrorView's resource prop is passed as a raw English noun by all six routes that
use it, interpolating English into an otherwise-translated sentence. Fixing one call site
would be inconsistent; it wants a single pass across all of them.

QA

• make build-backend lint-back — clean, 0 lint issues
• make build-dash0 + bun run lint — 42 errors, exactly the pre-existing baseline;
  every touched file verified individually against its pre-change version
• bun run test:unit — 1485 passing
• demo-account.spec.ts — 18/18 against a side-car test server, including a rebuilt
  pre-fix negative control that fails exactly as reported and passes once restored

🤖 Generated with Claude Code