Fix all translations files and harden their consistency

[Vondry]

Summary

Audits and repairs the messages, security, and validators translation catalogues (translations/*.xlf, 3 domains × ~14–16 locales), then adds two permanent tooling scripts to keep the catalogues correct and in sync going forward.

Translation catalogue fixes

• Removed dead and duplicate keys from messages.en.xlf and validators.en.xlf, including deleted-template leftovers, superseded field labels, wrong-domain duplicates, 21 corrupted hex-keyed entries, and 8 obsolete demo entries in validators.en.xlf. Deleted validators.it/pl/pt_BR.xlf, which contained only those invalid entries.
• Added missing keys: general.phrase.none (messages) and the three Symfony login-throttling messages (security), which were referenced by the application but missing from the catalogues.
• Synchronized every locale with the English catalogue, ensuring identical key sets, ordering, and unit IDs across all 42 files. Recreated validators.it/pl/pt_BR.xlf from Symfony vendor catalogues, converted legacy XLIFF 1.2 files (hu, pt_BR, and zh_CN variants) to XLIFF 2.0, and corrected <file id> / trgLang mismatches (el, tr, and uk).
• Fixed approximately 77 incorrect translations, including unescaped Twig placeholders ({{limit}} → {{ limit }}), mistranslated placeholder names (e.g. German %Stunden% → %hours%), missing placeholders, incorrect translations (e.g. Russian "preview" translated as "list"), and structural issues such as missing sr-only spans and key-as-target fallbacks.
• Regenerated <notes> blocks for every catalogue, documenting actual usage locations. messages keys now reference in-repository path:line locations, while security and validators entries reference the originating Symfony/vendor source when no in-project usage exists.

New tooling

• bin/validate-translations — a CI-safe validator (exit code 1 on failure) that verifies:
  • The expected manifest of domain.locale.xlf files (missing files are treated as errors).
  • Full structural parity with the English catalogue, including keys, unit IDs, <notes>, ordering, and byte-level skeleton structure.
  • Correct <file id> and trgLang headers (now enforced as hard errors).
  • Graceful reporting of malformed or truncated XML instead of fatal crashes.
  • That every messages key is referenced somewhere in the codebase (code, templates, themes, or bundled widgets), and every trans(), |trans, or __() call resolves to a real translation key.
• bin/update-translation-notes — regenerates <notes> blocks from actual usage and mirrors them identically into every locale. Falls back to Symfony vendor sources for security and validators entries without in-project references. Heuristic (non-exact) matches are prefixed with ~, locations are sorted numerically by line number, and shared vendor directories are scanned only once.
• Integrated into CI (.github/workflows/code_analysis.yaml), adding php bin/validate-translations alongside the existing lint:xliff step.

Testing

• php bin/console lint:xliff translations/ — all 42 catalogue files validate successfully.
• php bin/validate-translations — passes cleanly (exit code 0).
• php bin/console debug:translation <locale> --domain=<domain> — spot-checked across multiple locales and domains with zero missing keys.
• Fault injection (deleted locale file, corrupted trgLang, malformed XML, reordered/tampered <notes>, and duplicate keys) was correctly detected by bin/validate-translations, after which each change was reverted.

Screen.Recording.2026-07-20.at.10.56.11.mov

[Vondry]

Related localization PRs:

• Localize Redactor editor UI based on Bolt backend locale redactor#41
• Localize Article editor UI based on Bolt backend locale article#49