feat: FASE 2 - Client Base (layout, login, navbar, tema, i18n)

Implementazione completa del frontend Flask:
- Layout base.html con TailwindCSS CDN, dark/light theme, flash messages
- Navbar responsive role-based (Maker, MeasurementTec, Metrologist, Admin)
- Login page professionale con form + API integration
- Profilo utente: nome, lingua, tema, badge ruoli
- Sistema tema dark/light: CSS variables + Alpine.js store + localStorage
- i18n completo IT/EN: Flask-Babel (.po) + alpinejs-i18n (JSON)
- API Client riscritto: error handling normalizzato, no crash su 4xx/5xx
- CSRF protection con Flask-WTF su tutti i form
- Logo aziendale dinamico da system_settings
- Asset SVG: tmflow-logo.svg + tmflow-icon.svg (favicon)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

client/app.py

@@ -3,6 +3,7 @@ import os
 
 from flask import Flask, redirect, url_for, session, request
 from flask_babel import Babel
+from flask_wtf.csrf import CSRFProtect
 
 from config import Config
 
@@ -23,6 +24,9 @@ def create_app() -> Flask:
     app = Flask(__name__)
     app.config.from_object(Config)
 
+    # Initialize CSRF protection
+    csrf = CSRFProtect(app)
+
     # Initialize Flask-Babel
     Babel(app, locale_selector=get_locale)
 
@@ -44,6 +48,13 @@ def create_app() -> Flask:
             return redirect(url_for("measure.select_recipe"))
         return redirect(url_for("auth.login"))
 
+    @app.route("/set-language/<lang>")
+    def set_language(lang):
+        """Set user's preferred language and store in session."""
+        if lang in Config.LANGUAGES:
+            session["language"] = lang
+        return redirect(request.referrer or url_for("auth.login"))
+
     @app.context_processor
     def inject_globals():
         """Inject global variables into all templates."""
@@ -52,6 +63,7 @@ def create_app() -> Flask:
             "current_theme": session.get("theme", "light"),
             "current_language": get_locale(),
             "languages": Config.LANGUAGES,
+            "company_logo": session.get("company_logo"),
         }
 
     return app