#21: finish the three translations across every screen

F4's acceptance criterion asks for the three translations to be 100%
complete with the language lint green. The bundles had parity but the
admin screens and the account area were still hardcoded English: 63
visible strings that no locale could reach.

They now come from a shared ui namespace, so the three bundles cannot
drift apart, and all three carry 126 keys.

The language lint also caught this branch's own Go tests: the RFC 2047
cases need accented output to be worth anything, and the delivery test
had Portuguese fixture text. The expectations are written as Go escapes
instead, which keeps the assertions and leaves the source ASCII, and the
fixture text is English.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/webmail/messages/es.json

@@ -79,5 +79,64 @@
     "unauthorized": "Sesión expirada o no autorizada",
     "forbidden": "Acceso prohibido para esta superficie de cuenta",
     "serverError": "Ocurrió un error interno en el servidor"
+  },
+  "ui": {
+    "accountStatus": "Estado de la cuenta",
+    "actions": "Acciones",
+    "active": "ACTIVA",
+    "activeSessions": "Sesiones activas del webmail",
+    "actor": "Autor / cuenta",
+    "actualRecord": "Registro DNS actual (Cloudflare)",
+    "allChecksPassed": "TODAS LAS COMPROBACIONES PASARON",
+    "appPasswordGenerated": "Contrasena de aplicacion generada:",
+    "appPasswordsSection": "Contrasenas de aplicacion (clientes IMAP / SMTP)",
+    "attempts": "Intentos",
+    "clientIp": "IP del cliente",
+    "copyPasswordNow": "Copie esta contrasena ahora. No se mostrara de nuevo.",
+    "coreInfra": "Estado de la infraestructura",
+    "currentSession": "Sesion actual de este navegador",
+    "daneVerified": "DANE / MTA-STS verificado",
+    "destination": "Destino",
+    "diskUsed": "Uso de disco",
+    "dkimResult": "Resultado DKIM",
+    "dkimAlignment": "Alineacion de la firma DKIM",
+    "dmarcEnforcement": "Aplicacion de la politica DMARC",
+    "domainVerification": "Estado de la verificacion del dominio",
+    "emailAddress": "Direccion de correo",
+    "eventAction": "Accion registrada",
+    "expectedValue": "Valor esperado por la especificacion",
+    "healthy": "SALUDABLE",
+    "imapEngine": "Servidor IMAP (143/993)",
+    "inboundVolume": "Volumen de entrada (24h)",
+    "jobId": "ID del trabajo",
+    "lastError": "Ultimo error",
+    "liveMetrics": "Metricas operativas del nodo de correo.",
+    "localDisk": "Almacenamiento en disco local",
+    "preflightTitle": "Diagnostico de preflight del servidor",
+    "messageBody": "Cuerpo del mensaje",
+    "messageVolume": "Volumen de mensajes",
+    "noAppPasswords": "Aun no se generaron contrasenas de aplicacion.",
+    "online": "EN LINEA",
+    "outboundDelivered": "Entregados en salida (24h)",
+    "queueDepth": "Profundidad de la cola",
+    "postgresRunner": "Ejecutor de tareas Postgres activo",
+    "provisionMailbox": "Crear nuevo buzon",
+    "recipient": "Destinatario",
+    "recordName": "Nombre del registro",
+    "reportingOrg": "Organizacion que informo",
+    "scanners": "Rspamd (antispam) y ClamAV",
+    "sender": "Remitente",
+    "smtpListener": "Servidor SMTP (25/587/465)",
+    "sourceIp": "IP de origen",
+    "spfRatio": "Tasa de alineacion SPF",
+    "spfResult": "Resultado SPF",
+    "storageQuota": "Cuota de almacenamiento",
+    "subject": "Asunto",
+    "targetObject": "Objeto destino",
+    "timestamp": "Fecha y hora",
+    "toRecipients": "Para (destinatarios)",
+    "totalEvaluated": "Total de mensajes evaluados",
+    "twoFactorSection": "Autenticacion en dos pasos (TOTP RFC 6238)",
+    "watching": "OBSERVANDO"
   }
 }