fix: code review — security fixes, dedup, cleanup

- setup: validate roles against users.VALID_ROLES (Supervisor was missing)
- files: fix path traversal prefix-match edge case (is_relative_to),
  dedupe path validation into resolve_upload_path(), use logging not print
- measurements: extract shared _build_measurement_filters() helper
- client app: prevent open redirect via Referer on /set-language
- maker: guard resp.json() in parse-technical-sheet proxy
- measure/maker: extract shared file proxy into services/file_proxy.py
- measure: localize supervisor validation error messages
- annotation-editor: remove global keydown listener in destroy()

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/frontend/flask_app/services/file_proxy.py

@@ -0,0 +1,25 @@
+"""Shared file proxy: relay uploads from the FastAPI server to the browser.
+
+The browser can't send the X-API-Key header directly, so blueprints expose
+a proxy route and delegate here.
+"""
+import requests as http_requests
+from flask import Response, session
+
+from config import Config
+
+
+def proxy_file(file_path: str) -> Response:
+    """Fetch a file from the API server and relay it with its content type."""
+    base_url = Config.API_SERVER_URL.rstrip("/")
+    resp = http_requests.get(
+        f"{base_url}/api/files/{file_path}",
+        headers={"X-API-Key": session.get("api_key", "")},
+        timeout=30,
+    )
+    if resp.status_code != 200:
+        return Response(resp.text, status=resp.status_code)
+    return Response(
+        resp.content,
+        content_type=resp.headers.get("content-type", "application/octet-stream"),
+    )