fix: harden identity, live access, drafts and setup (review only)

Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.

internal/pkg/i18nx/locales/en-US.yml

@@ -1,3 +1,4 @@
+# Modified in the independent hardening fork; upstream notices retained.
 error.e0001: "AI Agent not found"
 error.e0002: "AI Agent not found."
 error.e0003: "AI Agent not found or disabled."
@@ -567,3 +568,12 @@ tool.graph.prepareTicketDraft.param.expectedOutcome: "The user's expected outcom
 tool.graph.prepareTicketDraft.param.currentAttempt: "Current attempted troubleshooting steps. Optional."
 error.setup.invalidQuickFixAction: "Unsupported setup quick-fix action: %v"
 error.setup.authRequired: "Sign in to run setup diagnostics or quick fixes"
+
+error.setup.previewRequired: "Review a setup preview and explicitly confirm its token before applying changes."
+error.setup.previewChanged: "Configuration changed since the preview. Review a new preview before applying."
+error.setup.targetRequired: "Select a specific existing record, or use its settings to choose the intended configuration."
+error.setup.targetUnavailable: "The selected record is unavailable, deleted or ineligible. It was not restored."
+error.setup.persistenceFailed: "Setup configuration could not be read or saved. No incomplete repair was committed."
+error.setup.bypassUnsupported: "Bypassing AI is not supported by this diagnostic. Run a human-only route check or test AI separately."
+error.channel.configChanged: "The channel configuration changed. Reload it and review your changes before saving again."
+error.channel.configUpdateFailed: "The channel configuration could not be saved. Please try again."