feat: unify language handling across the application

- Updated the language configuration to use a single source of truth from `DEFAULT_LANGUAGE` for the bot, API, and Mini App, eliminating auto-detection from user settings.
- Refactored the `get_lang` function to always return `DEFAULT_LANGUAGE`, ensuring consistent language usage throughout the application.
- Modified the handling of language in various components, including API responses and UI elements, to reflect the new language management approach.
- Enhanced documentation and comments to clarify the changes in language handling.
- Added unit tests to verify the new language handling behavior and ensure coverage for the updated functionality.

duty_teller/api/app.py

@@ -5,7 +5,6 @@ import re
 from datetime import date, timedelta
 
 import duty_teller.config as config
-from starlette.middleware.base import BaseHTTPMiddleware
 
 from fastapi import Depends, FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
@@ -58,22 +57,67 @@ app.add_middleware(
 )
 
 
-class NoCacheStaticMiddleware(BaseHTTPMiddleware):
-    """Set Cache-Control for /app/*.js and /app/*.html so WebView gets fresh JS (i18n, etc.)."""
+class NoCacheStaticMiddleware:
+    """
+    Raw ASGI middleware: Cache-Control: no-store for all /app and /app/* static files;
+    Vary: Accept-Language on all responses so reverse proxies do not serve one user's response to another.
+    """
 
-    async def dispatch(self, request, call_next):
-        response = await call_next(request)
-        path = request.url.path
-        if path.startswith("/app/") and (
-            path.endswith(".js") or path.endswith(".html")
-        ):
-            response.headers["Cache-Control"] = "no-store"
-        return response
+    def __init__(self, app, **kwargs):
+        self.app = app
+
+    async def __call__(self, scope, receive, send):
+        if scope["type"] != "http":
+            await self.app(scope, receive, send)
+            return
+
+        path = scope.get("path", "")
+        is_app_path = path == "/app" or path.startswith("/app/")
+
+        async def send_wrapper(message):
+            if message["type"] == "http.response.start":
+                headers = list(message.get("headers", []))
+                header_names = {h[0].lower(): i for i, h in enumerate(headers)}
+                if is_app_path:
+                    cache_control = (b"cache-control", b"no-store")
+                    if b"cache-control" in header_names:
+                        headers[header_names[b"cache-control"]] = cache_control
+                    else:
+                        headers.append(cache_control)
+                vary_val = b"Accept-Language"
+                if b"vary" in header_names:
+                    idx = header_names[b"vary"]
+                    existing = headers[idx][1]
+                    tokens = [p.strip() for p in existing.split(b",")]
+                    if vary_val not in tokens:
+                        headers[idx] = (b"vary", existing + b", " + vary_val)
+                else:
+                    headers.append((b"vary", vary_val))
+                message = {"type": "http.response.start", "status": message["status"], "headers": headers}
+            await send(message)
+
+        await self.app(scope, receive, send_wrapper)
 
 
 app.add_middleware(NoCacheStaticMiddleware)
 
 
+@app.get(
+    "/app/config.js",
+    summary="Mini App config (language)",
+    description="Returns JS that sets window.__DT_LANG from DEFAULT_LANGUAGE. Loaded before main.js.",
+)
+def app_config_js() -> Response:
+    """Return JS assigning window.__DT_LANG for the webapp. No caching."""
+    lang = config.DEFAULT_LANGUAGE
+    body = f'window.__DT_LANG = "{lang}";'
+    return Response(
+        content=body,
+        media_type="application/javascript; charset=utf-8",
+        headers={"Cache-Control": "no-store"},
+    )
+
+
 @app.get(
     "/api/duties",
     response_model=list[DutyWithUser],