fix(ci): green build — en translations, quiet docker npm, local CI check

Three fixes so Gitea CI is green and stays that way:

- **ng build --localize**: `messages.en.xlf` (hand-maintained, matched by id) had drifted
  ~93 units behind the source since WP-24 — `beheer.*`, `brief.canvas.*`, `brief.diff.*`,
  `orgTemplate.*`, `brief.besluit.*`, etc. With `i18nMissingTranslation: "error"` that fails
  the frontend job. Added English `<target>`s for every missing unit (interpolation `<x/>`
  tags preserved); both nl + en bundles build clean.
- **docker npm noise**: the web container's `npm ci` now runs `--no-fund --loglevel=error`,
  so `docker compose up` boots without npm 11's deprecation / allow-scripts / funding
  warnings (verified in the running container: 0 warning lines). The underlying Angular
  webpack-builder deprecation is upstream; migrating to @angular/build is out of scope.
- **local CI check**: `scripts/ci-local.sh` + `npm run ci` mirror the CI jobs (lint,
  format:check, check:tokens, test, build --localize, audit, backend format+test,
  api-client drift; `--full` adds storybook-a11y) so a red build is caught before pushing.
  Opt-in pre-push hook at scripts/githooks/pre-push. Documented in CLAUDE.md.

Verified: `npm run ci` passes end-to-end; storybook-a11y 169/169 (the local parallel-worker
timeouts were the docker stack starving chromium, not a regression).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/ci-local.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Run the CI gate locally before pushing, so a red Gitea build is caught here first.
+# Mirrors .github/workflows/ci.yml. The default runs every job that needs no browser or
+# running servers (frontend + backend + api-client-drift). `--full` also runs the
+# storybook-a11y job (self-contained). The e2e job needs the dev servers up, so it is NOT
+# chained here — run it separately (see the note printed at the end).
+#
+# Assumes dependencies are installed (`npm ci` already run); CI installs them itself.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+step() { printf '\n\033[1;36m▶ %s\033[0m\n' "$1"; }
+
+step "lint";                      npm run lint
+step "format:check (prettier)";   npm run format:check
+step "check:tokens";              npm run check:tokens
+step "test (vitest)";             npm test
+step "build --localize (nl+en)";  npx ng build --localize
+step "npm audit (shipped deps)";  npm audit --omit=dev
+step "backend format + tests";    ( cd backend && dotnet format BigRegister.slnx --verify-no-changes && dotnet test BigRegister.slnx )
+step "api-client drift";          npm run gen:api && git diff --exit-code src/app/shared/infrastructure/api-client.ts backend/swagger.json
+
+if [[ "${1:-}" == "--full" ]]; then
+  step "storybook build + axe";   npm run build-storybook && npm run test-storybook:ci
+fi
+
+printf '\n\033[1;32m✔ local CI passed\033[0m\n'
+printf 'Note: the e2e job is not run here — it needs the backend + ng serve up. Run:\n'
+printf '  (backend) dotnet run --project backend/src/BigRegister.Api --urls http://localhost:5000 &\n'
+printf '  (frontend) npx ng serve &  then  npm run e2e\n'

scripts/githooks/pre-push

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Opt-in pre-push hook: run the local CI gate before every push.
+# Enable once with:  git config core.hooksPath scripts/githooks
+# Skip a single push with:  git push --no-verify
+exec "$(git rev-parse --show-toplevel)/scripts/ci-local.sh"