feat: internationalize API error responses by locale

Add shared error codes with zh/en/ms messages, coded app exceptions,
and locale-aware global filter. Frontends send X-Locale so error text
matches the active UI language.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/infrastructure/database/database-reset.service.ts

@@ -1,4 +1,5 @@
-import { ForbiddenException, Injectable } from '@nestjs/common';
+import { Injectable } from '@nestjs/common';
+import { appForbidden } from '../../shared/common/app-error';
 import { PrismaService } from '../../shared/prisma/prisma.service';
 import { DEMO_ACCOUNTS, runSeed } from './run-seed';
 
@@ -13,7 +14,7 @@ export class DatabaseResetService {
 
   async resetDatabase(): Promise<{ demoAccounts: readonly string[] }> {
     if (!this.isAllowed()) {
-      throw new ForbiddenException('生产环境禁止重置数据库（需设置 ALLOW_DB_RESET=true）');
+      throw appForbidden('DB_RESET_FORBIDDEN');
     }
 
     await this.truncateApplicationTables();