Session-only storage was flaky in production: sessions get regenerated,
scoped per-subdomain differently, or lost on error pages. User reported
switcher had no effect on visible language.
Add a persistent 'app_locale' cookie set by the /locale/{lang} route.
SetLocale middleware now resolves in this order:
1. app_locale cookie (survives everything)
2. session locale
3. authenticated user.locale
4. tenant.settings.language
5. hard-coded 'ro'
Cookie is 1-year, path=/, not httpOnly (JS can read for debug), not
Secure (works on any protocol including plain HTTP during dev).
Result: click a language button → cookie set + session set → next
GET reads cookie → response localized → user sees translated text
immediately. Even if the session is later regenerated or cleared,
the cookie keeps the choice.
Suite: 306 passed (853 assertions). Unchanged.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Vasyka
d10480b9f4