feat: default locale Russian, geo determines language for other countries

- localization-svc: defaultLocale ru, resolveLocale only by geo
- web-svc: DEFAULT_LOCALE ru, layout lang=ru, embeddedTranslations fallback ru
- countryToLocale: default ru when no country or unknown country

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/k3s/auth-svc.yaml

@@ -0,0 +1,94 @@
+# auth-svc — SSO, JWT, Bearer validation (better-auth)
+# namespace: gooseek-auth
+# BETTER_AUTH_URL — для callback/redirect (https://gooseek.ru)
+# docs/architecture: 02-k3s-microservices-spec.md
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: auth-svc
+  namespace: gooseek-auth
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: auth-svc
+  template:
+    metadata:
+      labels:
+        app: auth-svc
+    spec:
+      containers:
+        - name: auth-svc
+          image: gooseek/auth-svc:latest
+          imagePullPolicy: Never
+          ports:
+            - containerPort: 3014
+          env:
+            - name: PORT
+              value: "3014"
+            - name: BETTER_AUTH_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: gooseek-env
+                  key: better-auth-url
+            - name: AUTH_SERVICE_URL
+              value: "http://auth-svc.gooseek-auth:3014"
+            - name: TRUSTED_ORIGINS
+              valueFrom:
+                configMapKeyRef:
+                  name: gooseek-env
+                  key: trusted-origins
+            - name: DATABASE_PATH
+              value: "/data/auth.db"
+            - name: BETTER_AUTH_TELEMETRY
+              value: "0"
+          volumeMounts:
+            - name: auth-data
+              mountPath: /data
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 3014
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 3014
+            initialDelaySeconds: 3
+            periodSeconds: 5
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+      volumes:
+        - name: auth-data
+          persistentVolumeClaim:
+            claimName: auth-data-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: auth-svc
+  namespace: gooseek-auth
+spec:
+  selector:
+    app: auth-svc
+  ports:
+    - port: 3014
+      targetPort: 3014
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: auth-data-pvc
+  namespace: gooseek-auth
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi