feat(locale): add locale packs and the locale audit endpoint

[ogulcan-gurcaglar]

Adds the locale pack tables and the locale audit endpoint.

[zeropath-ai-staging]

✅ No security or compliance issues detected. Reviewed everything up to 2e6ea63.

Security Overview

• 🔎 Scanned files: Diff unavailable for this run
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/5eea4b94-6a72-403c-af68-60abe8a1d179?scanId=7acf9db5-dab5-49eb-a54a-4046b61f6f54&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Diff information was unavailable for this scan.

[zeropath-ai-staging]

❌ 1 possible security or compliance issue detected. Reviewed everything up to 2e6ea63.

The following issues were found:

• Issue 1: SQL Injection

  • Location: routes/localeAudit.ts:12
  • Score: HIGH (85.0)
  • Description: The newly added locale audit route interpolates the attacker-controlled loc query parameter directly into a SQL statement. An unauthenticated attacker can supply SQL syntax in ?loc= to alter the WHERE clause and retrieve arbitrary rows from the Products table (and potentially exploit SQLite SQL capabilities).

Evidence: const loc = req.query.loc ?? '' reads request query input, then models.sequelize.query(\SELECT * FROM Products WHERE name = '${loc}'`)executes it without bind parameters or escaping. The route is registered asapp.get('/rest/locale/audit', localeAudit())` with no visible authentication middleware.

• Link to UI: https://staging.branch.zeropath.com/app/issues/449180c6-3a98-41b2-b206-06f9df646eb5 (Issue 1, id: 449180c6-3a98-41b2-b206-06f9df646eb5)

Security Overview

• 🔎 Scanned files: Diff unavailable for this run
• 🔗 Scan Link: https://staging.branch.zeropath.com/app/repositories/76e78572-4c4d-4c18-8702-81b7a5a6273c?scanId=5326be79-fd11-4efd-b08f-45556dd51f8b&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Diff information was unavailable for this scan.