followup: SafeVaultPath in note update, email i18n, strict check-i18n.sh

- applyRemoteNoteUpdate: use SafeVaultPath for vault mode, skip non-vault with log
- Email subjects/bodies moved to Go i18n (confirm + reset) in ru.json and en.json
- check-i18n.sh: ru/en key mismatch now FAIL (not WARNING)
- All builds, tests, frontend pass

cmd/verstak-gui/sync_apply.go

@@ -269,25 +269,28 @@ func (a *App) applyRemoteNoteUpdate(op syncsvc.Op) error {
 		return fmt.Errorf("note record not found: %w", err)
 	}
 
-	var abs string
 	if storageMode == "vault" {
-		abs = filepath.Join(a.vault, filePath)
-	} else {
-		abs = filePath
+		abs, err := syncsvc.SafeVaultPath(a.vault, filePath)
+		if err != nil {
+			return fmt.Errorf("unsafe vault path in note update: %w", err)
+		}
+		if err := os.WriteFile(abs, []byte(payload.Content), 0o640); err != nil {
+			return err
+		}
+		info, _ := os.Stat(abs)
+		size := int64(0)
+		if info != nil {
+			size = info.Size()
+		}
+		now := time.Now().UTC().Format(time.RFC3339)
+		_, e := a.db.Exec(
+			`UPDATE files SET size=?, updated_at=? WHERE path=? AND storage_mode=?`,
+			size, now, filePath, storageMode)
+		return e
 	}
-	if err := os.WriteFile(abs, []byte(payload.Content), 0o640); err != nil {
-		return err
-	}
-	info, _ := os.Stat(abs)
-	size := int64(0)
-	if info != nil {
-		size = info.Size()
-	}
-	now := time.Now().UTC().Format(time.RFC3339)
-	_, e := a.db.Exec(
-		`UPDATE files SET size=?, updated_at=? WHERE path=? AND storage_mode=?`,
-		size, now, filePath, storageMode)
-	return e
+	log.Printf("applyRemoteNoteUpdate: skipping non-vault note update for node %s (mode=%s, path=%s)",
+		payload.NodeID, storageMode, filePath)
+	return nil
 }
 
 func (a *App) applyRemoteFileOrFolderOp(op syncsvc.Op) error {