feat: default locale Russian, geo determines language for other countries

- localization-svc: defaultLocale ru, resolveLocale only by geo
- web-svc: DEFAULT_LOCALE ru, layout lang=ru, embeddedTranslations fallback ru
- countryToLocale: default ru when no country or unknown country

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/k3s/network-policies.yaml

@@ -0,0 +1,17 @@
+# NetworkPolicy — базовая сетевая изоляция
+# docs/architecture: 05-gaps-and-best-practices.md §3
+# Разрешает трафик внутри namespace gooseek (chat→search, cache-worker→redis и т.д.)
+# Для production добавьте ingress namespace в from
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: gooseek-allow-internal
+  namespace: gooseek
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector: {}