fix(ci): green build — en translations, quiet docker npm, local CI check

Three fixes so Gitea CI is green and stays that way:

- **ng build --localize**: `messages.en.xlf` (hand-maintained, matched by id) had drifted
  ~93 units behind the source since WP-24 — `beheer.*`, `brief.canvas.*`, `brief.diff.*`,
  `orgTemplate.*`, `brief.besluit.*`, etc. With `i18nMissingTranslation: "error"` that fails
  the frontend job. Added English `<target>`s for every missing unit (interpolation `<x/>`
  tags preserved); both nl + en bundles build clean.
- **docker npm noise**: the web container's `npm ci` now runs `--no-fund --loglevel=error`,
  so `docker compose up` boots without npm 11's deprecation / allow-scripts / funding
  warnings (verified in the running container: 0 warning lines). The underlying Angular
  webpack-builder deprecation is upstream; migrating to @angular/build is out of scope.
- **local CI check**: `scripts/ci-local.sh` + `npm run ci` mirror the CI jobs (lint,
  format:check, check:tokens, test, build --localize, audit, backend format+test,
  api-client drift; `--full` adds storybook-a11y) so a red build is caught before pushing.
  Opt-in pre-push hook at scripts/githooks/pre-push. Documented in CLAUDE.md.

Verified: `npm run ci` passes end-to-end; storybook-a11y 169/169 (the local parallel-worker
timeouts were the docker stack starving chromium, not a regression).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -23,10 +23,24 @@ npm run lint       # eslint — enforces `any`-free code + import/layer boundari
 npm run build      # ng build (must stay green)
 npm run storybook  # component library by atomic layer
 npm run gen:api    # regenerate the typed client from the backend OpenAPI doc
+npm run ci         # run the CI gate locally BEFORE pushing (mirrors ci.yml); `npm run ci --full` adds storybook-a11y
 docker compose up  # run FE + backend together (Swagger at :5000/swagger)
 cd backend && dotnet test   # backend rule + endpoint tests
 ```
 
+**Run `npm run ci` before every push** (`scripts/ci-local.sh`) — it runs the same jobs
+Gitea CI does (lint, format:check, check:tokens, test, `ng build --localize`, audit, backend
+format+test, api-client drift), so a red build is caught locally. Two ways to make it
+automatic: `npm run ci` by hand, or enable the opt-in hook with
+`git config core.hooksPath scripts/githooks` (runs it on `git push`; bypass once with
+`--no-verify`). The e2e + storybook-a11y jobs need a browser/servers — run `--full` for
+storybook-a11y; e2e separately (the script prints how).
+
+**Second-locale gate:** `messages.en.xlf` is a hand-maintained translation of every
+`$localize` id; `ng build --localize` fails (via `i18nMissingTranslation: error`) if any id
+lacks an English `<target>`. Add one whenever you add a `$localize` string — `npm run ci`
+catches a miss before CI does.
+
 `.npmrc` sets `legacy-peer-deps=true` (Storybook's peer range lags Angular 22).
 Do not run `npm audit fix --force` — it downgrades Angular 22→21. Dev-only
 advisories are pinned via `package.json` `overrides`; the shipped bundle audits clean.