fix(approvals,l10n,theme): usertest findings — localized prompts, no-data confirm, .chain log path, honest wording, AA contrast

- approvals: empty/legacy hub prompts render the localized fallback;
  approving without show: data asks for conscious confirmation first
- chain_log: write to ~/.chain/logs/studio-errors.log (was .fai),
  one-time best-effort migration of the legacy file + rotation sibling
- l10n: 'manipulationssicher' -> 'manipulationserkennend', neutral
  WORM-1 blurb, doctor pill 'Integritätskette v1', federation hint
  says the CA authenticates the first connect (DE+EN)
- theme: muted text token now >=4.5:1 on canvas, cards and elevated
  dark surfaces (was 3.7:1 on cards)

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

CHANGELOG.md

@@ -5,6 +5,31 @@ version + `kStudioVersion` in `lib/main.dart` stay in lockstep.
 
 ## Unreleased
 
+### Fixed (usertest 2026-07-10 findings)
+
+- **Approval prompts localize.** An approval whose flow step gave no
+  `prompt:` (and legacy rows carrying the hub's old baked-in English
+  sentence) now renders the localized fallback "Freigabe für diesen
+  Schritt erforderlich" / "Approval required for this step" — no more
+  English inside the German approvals UI.
+- **Approving without review data asks first.** When the approval step
+  attached no `show:` payload, "Freigeben" opens a calm confirmation
+  ("Ohne Prüfdaten freigeben?") explaining that the flow deliberately
+  attached no data, with an explicit "Trotzdem freigeben".
+- **Studio error log moved to `~/.chain/logs/`.** Writes went to the
+  pre-rename `~/.fai/logs/studio-errors.log` while the Doctor page and
+  `chain doctor` read `~/.chain/…`. Studio now writes to `.chain` and
+  migrates the old file (+ rotation sibling) over once.
+- **Honest audit wording (legal review).** DE strings no longer claim
+  "manipulationssicher" — the audit log is *manipulationserkennend*
+  (tamper-evident); "warum WORM-1 für KRITIS reicht" became a neutral
+  what-it-does-and-does-not sentence (EN too); the Doctor chain pill
+  says "Integritätskette v1" instead of "WORM-1"; the federation
+  enrollment hint says the CA *authenticates* the first connect.
+- **WCAG-AA secondary text on dark.** De-emphasised text was 3.7:1 on
+  cards; the muted token is now ≥ 4.5:1 against canvas, cards and
+  elevated surfaces.
+
 ### Added
 
 - **Live audit feed.** The Audit page subscribes to `streamEvents` and