fix(water-log): address code-review findings from i18n PR

- Session-expired bounce-to-PIN branch now matches the actual strings
  returned by requireFieldSession (was 'Session expired or invalid'
  which never matched). Added 'Session not found' and 'User is inactive'
  to the intercept list. The user-visible 'Your session expired. Please
  sign in again.' string is now in the dictionary (en + es).
- LangProvider moved up to WaterFieldClient. The orchestrator (which
  was sitting OUTSIDE the provider in b29caa0) now calls useLang()
  directly, so the loadHeadgates fallback error string is always
  rendered in the user's chosen language — even if they toggled
  after signing in.
- getClientLangSnapshot now memoizes the cookie value (React 19
  enforces getSnapshot purity stricter than 18).
- LanguageToggle switched from aria-pressed (toggle pattern) to
  role="radiogroup" + role="radio" + aria-checked (mutually-exclusive
  selector pattern). Per-button aria-labels dropped — the visible
  EN/ES text is read by SR as the radio name. Group label switched
  to t.common.a11yLanguage for Spanish parity.
- Notes textarea now has aria-label={t.log.notes} (was unlabeled —
  SR would announce 'Edit text' with no context).
- 1 new test: lock in that wl_lang=<script>...</script> falls through
  to the navigator (injection guard on the cookie regex).

Refs /tmp/refactor-water-log.md (review followups to Commit B)

tests/unit/water-log-i18n.test.ts

@@ -193,6 +193,16 @@ describe("detectInitialLang()", () => {
     stub.setNav({ language: "fr-FR" });
     expect(detectInitialLang()).toBe("es");
   });
+
+  it("ignores a wl_lang value that contains a JS payload (injection guard)", () => {
+    // Important: the regex in `detectInitialLang` only matches the
+    // exact 2-letter codes. Anything else must fall through to the
+    // navigator/default. This locks in that we never feed untrusted
+    // cookie contents into React state.
+    document.cookie = `${WL_LANG_COOKIE}=<script>alert(1)</script>; path=/`;
+    stub.setNav({ language: "en-US" });
+    expect(detectInitialLang()).toBe("en");
+  });
 });
 
 // ── setLangCookie ───────────────────────────────────────────────────