Resolve the page UI language once and let each ExApp fill its own Phrases.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/api.md

@@ -109,7 +109,15 @@ NextcloudIcons are SVG paths served by Nextcloud core under /core/img/. The libr
 func DialogHTML() template.HTML
 ```
 
-DialogHTML is the Dialog markup and script for an ExApp page. App navigation includes it. A page the ExApp renders itself inserts the same fragment. The page then calls exappDialog.message, exappDialog.confirm, or exappDialog.prompt and waits for the user's choice.
+DialogHTML is the Dialog markup and script for an ExApp page, in English. App navigation includes the same fragment in the UI language and does not take a language argument. A page the ExApp renders itself inserts this fragment, or Credentials.DialogHTML when that page has a request. The page then calls exappDialog.message, exappDialog.confirm, or exappDialog.prompt and waits for the user's choice.
+
+### FillScript
+
+```go
+func FillScript() template.HTML
+```
+
+FillScript replaces English source after load and refreshes Fold from the visible item name. It does not parse Phrase text as HTML. App navigation includes it. A page the ExApp renders itself places Script in the head and FillScript at the end of the body.
 
 ### ParseCacheSeconds
 
@@ -275,6 +283,15 @@ type AppNavigation struct {
 	// DisableTheme skips the Nextcloud theme stylesheets. The zero value
 	// loads the active theme.
 	DisableTheme	bool
+	// Cred reads the UI language for this page from Nextcloud.
+	// The zero value leaves the page in English.
+	// The caller does not pass a language.
+	Cred	Credentials
+	// Phrases is the ExApp's set. The page script receives it.
+	// Library chrome is not included. The zero value leaves the page in English.
+	Phrases	Phrases
+	// MissingPhrase names the ExApp Phrase for MissingMessage.
+	MissingPhrase	string
 }
 ```
 
@@ -340,6 +357,22 @@ func (c Credentials) AuthHeaders() http.Header
 
 AuthHeaders returns AppAPI headers for a request to Nextcloud. The set is AA-VERSION, EX-APP-ID, EX-APP-VERSION, AUTHORIZATION-APP-API, and OCS-APIRequest. AUTHORIZATION-APP-API is base64 of UserID, a colon, and AppSecret. The method does not return an error; empty fields are sent as empty.
 
+#### Credentials.DialogHTML
+
+```go
+func (c Credentials) DialogHTML(r *http.Request) template.HTML
+```
+
+DialogHTML is the Dialog fragment in the UI language of r. A missing Requesting user or a failed read uses English. The caller does not pass a language.
+
+#### Credentials.UILanguage
+
+```go
+func (c Credentials) UILanguage(r *http.Request) string
+```
+
+UILanguage is the language of the Phrases for this request, "en" or "de". It reads the Requesting user's language from the Provisioning OCS user record and forwards the request's Accept-Language on that read. The locale field is ignored. A more specific code uses the broader language when this Library provides that language. Any other code, a missing Requesting user, or a failed read is English, and the page still renders. A second call with the request returned from a page render reuses that result.
+
 #### Credentials.WithUser
 
 ```go
@@ -399,11 +432,12 @@ type Item struct {
 	ID		string
 	Label		string
 	Icon		string
+	Phrase		string
 	Children	[]Item
 }
 ```
 
-Item is one App navigation entry. The ExApp chooses the ids and labels. Children may nest. The shell does not interpret the ids. Icon is an optional same-origin image URL. NextcloudIcons names the core SVGs.
+Item is one App navigation entry. The ExApp chooses the ids and labels. Children may nest. The shell does not interpret the ids. Icon is an optional same-origin image URL. NextcloudIcons names the core SVGs. Phrase names the ExApp Phrase for Label. The English label stays in the page until the script replaces it. Empty leaves the label as written.
 
 ### Notification
 
@@ -425,10 +459,11 @@ Notification is one Nextcloud bell for a single Recipient.
 type OCSClient struct {
 	Cred	Credentials
 	Client	*http.Client
+	Header	http.Header
 }
 ```
 
-OCSClient performs AppAPI-authenticated OCS requests with format=json.
+OCSClient performs AppAPI-authenticated OCS requests with format=json. Header is copied onto the outbound request after the AppAPI auth headers. The UI language read uses it to forward Accept-Language.
 
 #### OCSClient.Call
 
@@ -446,3 +481,53 @@ func (c OCSClient) URL(path string) string
 
 URL builds an OCS URL under /ocs/v2.php with format=json.
 
+### Phrases
+
+```go
+type Phrases struct {
+	// contains filtered or unexported fields
+}
+```
+
+Phrases is one ExApp's merged Phrase set. English is the complete set. A module set is merged with Merge; a repeated id uses the set added later. The page script receives this set. Library chrome is not included.
+
+#### Merge
+
+```go
+func Merge(sets ...Phrases) Phrases
+```
+
+Merge returns the sets combined in order. A repeated id uses the text from the set added later.
+
+#### ParsePhrases
+
+```go
+func ParsePhrases(en, de []byte) (Phrases, error)
+```
+
+ParsePhrases reads an English object and a German object.
+
+#### PhrasesFromFS
+
+```go
+func PhrasesFromFS(fsys fs.FS) (Phrases, error)
+```
+
+PhrasesFromFS reads i18n/en.json and i18n/de.json. Each file is one JSON object of id → text.
+
+#### Phrases.Script
+
+```go
+func (p Phrases) Script(lang string) template.HTML
+```
+
+Script defines exappPhrase for the page, from this set only.
+
+#### Phrases.Sentence
+
+```go
+func (p Phrases) Sentence(lang, id string, holes map[string]string) string
+```
+
+Sentence is the finished text for lang. A missing text for that language uses the English text. An id missing from English is the id. A hole with no value stays visible as {name}. The result is plain text; the caller escapes it when writing HTML.
+