fix(l10n): low-severity language findings from the usertest panel

- 'Mit Endpunkt verbinden' — no Endpoint/Endpunkt mix
- audit-chain lead term is 'Hash-Kette' everywhere (doctor pill);
  chain detail says 'Verkettung lückenlos geprüft' instead of the
  raw field name prev_event_sha256
- welcome checklist line says who refreshes what
- setup privacy note explains the local model instead of ending in
  a bare model tag
- default project renders localized ('Allgemein') in the switcher;
  sealed-area status pills explain run state on hover

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_en.arb

@@ -83,7 +83,7 @@
     }
   },
   "welcomeChecklistHeader": "GETTING STARTED",
-  "welcomeChecklistBody": "Four steps to a working hub. Live state — refresh after changing anything.",
+  "welcomeChecklistBody": "Four steps to a working hub. The list shows the live state — refresh top right after changing anything.",
   "welcomeChecklistAi": "Configure System AI",
   "welcomeChecklistAiHint": "Settings → System AI. Required for the AI search and inline failure explanations.",
   "welcomeChecklistMcp": "Connect a public tool catalog",
@@ -1236,7 +1236,7 @@
   "doctorDaemonFilesSection": "Daemon files",
   "doctorDaemonControlSection": "Daemon control",
   "doctorChainIntact": "Hash chain intact",
-  "doctorChainIntactDetail": "{n} {n, plural, =1{event} other{events}} · prev_event_sha256 verified end-to-end",
+  "doctorChainIntactDetail": "{n} {n, plural, =1{event} other{events}} · linkage verified end-to-end",
   "@doctorChainIntactDetail": {
     "placeholders": {
       "n": {
@@ -1259,7 +1259,7 @@
       }
     }
   },
-  "doctorChainPillOk": "Integrity chain verified",
+  "doctorChainPillOk": "Hash chain verified",
   "doctorChainPillTamper": "TAMPER",
   "doctorVerifyNow": "Verify now",
   "doctorRestart": "Restart",
@@ -1780,6 +1780,7 @@
   "federationCopied": "Copied to clipboard",
   "federationEnrollmentHint": "Hand the token to the satellite operator over a secure channel. The bundled CA authenticates the satellite's first connect.",
   "workspaceAll": "All projects",
+  "workspaceDefaultProject": "General",
   "workspaceSwitcherTooltip": "Workspace — filters this view and stamps new runs with the selected project",
   "workspaceProtectedHint": "Protected: logically separated in the shared hub — no hard process barrier. Critical engagements use a sealed area.",
   "runsTitle": "Runs",
@@ -1804,6 +1805,8 @@
   "workspaceSealedHeader": "SEALED AREAS",
   "workspaceSealedRunning": "running",
   "workspaceSealedStopped": "stopped",
+  "workspaceSealedRunningHint": "The sealed area runs as its own hub process. Selecting it switches in.",
+  "workspaceSealedStoppedHint": "The sealed area is not running right now. Selecting it starts it and switches in.",
   "workspaceSealedStarting": "Starting sealed area “{name}”…",
   "@workspaceSealedStarting": {"placeholders": {"name": {"type": "String"}}},
   "workspaceSealedStarted": "Started sealed area “{name}”.",
@@ -1893,7 +1896,7 @@
   "setupApplyNotes": "Notes from the setup",
   "setupFreeTextHint": "e.g.: pre-screen incoming applications and flag incomplete ones",
   "setupFreeTextSuggest": "Suggest a setup",
-  "setupFreeTextPrivacyLocal": "Your description is processed locally on this machine ({model}).",
+  "setupFreeTextPrivacyLocal": "Your description is processed right on this machine — by the local AI model {model}. Nothing leaves the device.",
   "@setupFreeTextPrivacyLocal": {"placeholders": {"model": {"type": "String"}}},
   "setupFreeTextPrivacyRemote": "Your description is sent to the configured system AI: {model} ({provider}).",
   "@setupFreeTextPrivacyRemote": {"placeholders": {"model": {"type": "String"}, "provider": {"type": "String"}}},