chore(i18n): finish translating code comments and scripts to English

Completes the English-only standardization for code, comments, scripts
and CI templates (UI/CLI-facing strings stay bilingual pt-BR/en,
untouched). Covers the remaining crates/, apps/gui/ui/ and
apps/gui/src-tauri/ comments, .gitea/ workflow and template comments,
.githooks/ hooks, and the scripts/ source comments for the files
already renamed in a prior commit (check.sh, generate-logo.py,
install-hooks.sh).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

crates/guara-core/tests/sign.rs

@@ -1,4 +1,4 @@
-//! Assinatura digital: chaves, arquivos, adulteração, recuperação inteira e interoperabilidade.
+//! Ed25519 digital signature tests: keygen, signing, tamper detection, recovery verification, and OpenSSL interop.
 
 use guara_core::recover;
 use guara_core::sign::{self, SigningKey};
@@ -30,7 +30,7 @@ fn resident(id: u64, name: &str, bytes: Vec<u8>) -> Found {
     }
 }
 
-/// `recover` assina sozinho quando `GUARA_SIGNING_KEY` existe; testes que recuperam não se misturam.
+/// Serializes tests that mutate `GUARA_SIGNING_KEY` / `GUARA_CONFIG_DIR`.
 static ENV: std::sync::Mutex<()> = std::sync::Mutex::new(());
 
 fn keyed(dir: &Path) -> SigningKey {
@@ -46,7 +46,7 @@ fn key_roundtrip_and_no_overwrite() {
     let again = SigningKey::load(&dir.path().join("k.key")).unwrap();
     assert_eq!(k.public_bytes(), again.public_bytes());
     assert_eq!(k.fingerprint(), again.fingerprint());
-    assert_eq!(k.fingerprint().len(), 24); // 5 grupos de 4 + 4 separadores
+    assert_eq!(k.fingerprint().len(), 24); // 5 groups of 4 hex chars + 4 colons = 24 chars
     let pubfile = std::fs::read_to_string(dir.path().join("k.pub")).unwrap();
     assert!(pubfile.contains(&k.fingerprint()));
     let e = SigningKey::generate()
@@ -55,7 +55,7 @@ fn key_roundtrip_and_no_overwrite() {
         .unwrap()
         .to_string();
     assert!(e.contains("já existe uma chave"), "{e}");
-    // a chave antiga continua intacta
+    // existing private key is preserved untouched
     assert_eq!(
         SigningKey::load(&dir.path().join("k.key"))
             .unwrap()
@@ -92,26 +92,26 @@ fn signed_file_verifies_and_tampering_is_caught() {
         c.valid && c.trusted == Some(true) && c.signer.as_deref() == Some("Perita Ana"),
         "{c:?}"
     );
-    // fingerprint aceito em outro formato (maiúsculas, sem dois pontos)
+    // fingerprint comparison is case- and separator-insensitive
     let loose = k.fingerprint().replace(':', " ").to_uppercase();
     assert_eq!(
         sign::verify_file(&f, None, Some(&loose)).unwrap().trusted,
         Some(true)
     );
 
-    // outra chave não é a esperada
+    // mismatched trusted fingerprint sets `trusted = Some(false)`
     let other = SigningKey::generate().fingerprint();
     let c = sign::verify_file(&f, None, Some(&other)).unwrap();
     assert!(!c.valid && c.trusted == Some(false));
 
-    // arquivo alterado
+    // modifying the signed file invalidates the signature
     std::fs::write(&f, b"conteudo ALTERADO do relatorio").unwrap();
     let c = sign::verify_file(&f, None, None).unwrap();
     assert!(!c.valid && !c.file_matches && c.signature_valid, "{c:?}");
     std::fs::write(&f, b"conteudo do relatorio").unwrap();
     assert!(sign::verify_file(&f, None, None).unwrap().valid);
 
-    // campos da assinatura alterados (hora, assinante, hash) invalidam
+    // tampering with any signed metadata field (timestamp, signer, sha256) invalidates verification
     let raw = std::fs::read_to_string(&sig).unwrap();
     for (from, to) in [
         ("Perita Ana", "Outra Pessoa"),
@@ -122,7 +122,7 @@ fn signed_file_verifies_and_tampering_is_caught() {
         let c = sign::verify_file(&f, None, None).unwrap();
         assert!(!c.valid && !c.signature_valid, "{from}: {c:?}");
     }
-    // trocar a chave pública pela de outra pessoa também não passa
+    // replacing `public_key` with another keypair's public key fails verification
     let mut j: serde_json::Value = serde_json::from_str(&raw).unwrap();
     let evil = SigningKey::generate();
     j["chave_publica"] = evil
@@ -164,7 +164,7 @@ fn recovery_folder_is_checked_file_by_file() {
         "{c:?}"
     );
 
-    // manifesto adulterado (hash trocado para acompanhar o arquivo alterado) quebra a assinatura
+    // updating the manifest hash to match a tampered file invalidates the manifest's Ed25519 signature
     let m = std::fs::read_to_string(&manifest).unwrap();
     let real = &rep.recovered[0].sha256;
     let fake = sign::hash_file(&first).unwrap().0;
@@ -190,7 +190,7 @@ fn manifest_paths_cannot_escape_the_folder() {
     assert!(!c.valid && c.changed[0].contains("fora da pasta"), "{c:?}");
 }
 
-/// O mesmo que o `openssl` faria: a assinatura é Ed25519 padrão sobre a mensagem documentada.
+/// Verifies that our Ed25519 signature validates with external `openssl pkeyutl -verify -rawin`.
 #[test]
 fn signature_verifies_with_openssl() {
     let Ok(v) = std::process::Command::new("openssl")
@@ -239,7 +239,7 @@ fn signature_verifies_with_openssl() {
         ])
         .output()
         .unwrap();
-    // OpenSSL 1.1 não tem -rawin para Ed25519; só exige sucesso onde ele existe
+    // OpenSSL 1.1 lacks `-rawin` for Ed25519; only assert when `-rawin` is supported
     let text = String::from_utf8_lossy(&r.stdout).to_string() + &String::from_utf8_lossy(&r.stderr);
     if text.contains("Unknown option") || text.contains("unknown option") {
         return;
@@ -247,7 +247,7 @@ fn signature_verifies_with_openssl() {
     assert!(r.status.success(), "{text}");
 }
 
-/// Com chave configurada, a recuperação e o relatório saem assinados sem ninguém pedir.
+/// When `GUARA_SIGNING_KEY` is configured, `recover` and `report` auto-sign their outputs.
 #[test]
 fn configured_key_signs_manifest_automatically() {
     let _g = ENV.lock().unwrap_or_else(|e| e.into_inner());