🌐 Answer the API in the asker's language, photo suggestions too

The API skipped localized routes and so always spoke the default language: errors, activity messages and notification text reached a Danish iPhone in English. It now follows Accept-Language. Photo suggestions (title and description) are written in the request's language as well, on the web form too. :lock: Scope API tokens, use an https sign in callback, never link Apple sign in by email - ApiTokens get a scope: mcp tokens (made on the settings page) only work on /mcp, and the iPhone app's tokens only on /api. - The website hand-off redirects to https://<host>/app/callback, which iOS only gives to the app named in the new apple-app-site-association, instead of a custom URL scheme any app could claim. - Sign in with Apple no longer signs in to an existing account with the same email, since emails here are not verified. :sparkles: JSON API for the new iPhone app Bearer token auth on /api with the existing ApiTokens, Sign in with Apple (POST /api/session/apple), and a website hand-off at /app/authorize so every existing way of signing in works in the app without it handling passwords. Adds posting with a photo, editing and deleting, requesting, approving and rejecting, regions, charities filtered by currency, notifications, and the account (including deleting it, which App Review requires).