fix: language switcher works — GET route, simple links, forced RO fallback

The previous POST-based switcher failed silently: CSRF token check
returned 419 when clicking, and the session never persisted.

Root causes:
- POST requires @csrf token, but the test path fetched pages that had
  no matching form so the token in the DOM didn't match the session
- Some tenant subdomains had SESSION_DOMAIN scoped differently, so
  the cookie set by POST didn't come back on the follow-up GET
- Prod .env had APP_LOCALE=en which took precedence over the config
  edit; when session had no locale yet, defaulted to English

Fixes:

1. Route accepts BOTH GET and POST via Route::match(['get', 'post']).
   Setting your own language is not a security concern — GET is fine.

2. Route explicitly calls $request->session()->save() before redirect,
   forcing the session store to write before the redirect fires.
   Also honors ?redirect=<url> query so the user lands back on their
   original page rather than referer-guessing.

3. lang-switcher partial rewrites to plain <a href> tags (no @csrf,
   no forms). Each link points at /locale/{code}?redirect={current-url}
   so the switch happens in a single hop with predictable target.

4. SetLocale middleware hard-codes 'ro' as the ultimate fallback,
   ignoring config/env. The Romanian portal is the default
   client-facing surface; if a client has no session locale set and
   no user account, they see Romanian (safer than English which has
   no portal translations).

Suite: 306 passed (853 assertions). Unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/Http/Middleware/SetLocale.php

@@ -44,6 +44,8 @@ class SetLocale
             return $tenantLang;
         }
 
-        return config('app.locale', 'ro');
+        // Hard-code fallback la 'ro' — indiferent de APP_LOCALE din env,
+        // portal-ul client-facing e livrat cu RO ca implicit safe (RU disponibil via switcher).
+        return 'ro';
     }
 }