fix(docker-watcher): address final review findings

Security:
- Move config export behind auth middleware
- Validate OIDC callback token before storing in localStorage
- Use constant-time comparison for webhook secret
- Encrypt OIDC client secret at rest (like registry tokens)

Performance:
- Make TriggerDeploy async from HTTP handlers (return deploy ID
  immediately, run pipeline in background goroutine)

Robustness:
- Wrap api.ts res.json() in try/catch for non-JSON responses

i18n:
- Replace ~20 hardcoded English validation messages with $t() calls
- Localize ConfirmDialog cancel button, InstanceCard confirm titles,
  ProjectCard instance/instances pluralization
- Add validation keys to both en.json and ru.json

web/src/lib/components/ConfirmDialog.svelte

@@ -3,6 +3,7 @@
 -->
 <script lang="ts">
 	import { IconAlert } from '$lib/components/icons';
+	import { t } from '$lib/i18n';
 
 	interface Props {
 		open: boolean;
@@ -66,7 +67,7 @@
 					class="rounded-lg px-4 py-2 text-sm font-medium text-[var(--text-secondary)] hover:bg-[var(--surface-card-hover)] transition-colors active:animate-press"
 					onclick={oncancel}
 				>
-					Cancel
+					{$t('common.cancel')}
 				</button>
 				<button
 					type="button"