feat: add default_language to site config for banner i18n

Site owners can now set a default language for the consent banner,
overriding browser auto-detection. When null the banner uses
navigator.language / data-locale as before (existing behaviour).

Changes:
- DB: add default_language column to site_configs (nullable, String(10))
- API model: SiteConfig.default_language field
- API schema: SiteConfigCreate/Update/Response schemas
- Config resolver: pass default_language through to public config
- Banner types: SiteConfig.default_language field
- Banner logic: use config.default_language ?? detectLocale()
- Admin UI: SiteConfigTab dropdown with auto-detect option
- Admin UI types: SiteConfig.default_language added

apps/api/alembic/versions/0004_default_language.py

@@ -0,0 +1,34 @@
+"""default_language on site configs
+
+Revision ID: 0004
+Revises: 0003
+Create Date: 2026-06-15
+
+Allows site owners to set a default language for the banner,
+overriding the browser's auto-detection. The banner script uses
+this when loading translations.
+
+The column is nullable — NULL means "auto-detect from browser".
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision: str = "0004"
+down_revision: str | Sequence[str] | None = "0003"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "site_configs",
+        sa.Column("default_language", sa.String(10), nullable=True),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("site_configs", "default_language")

apps/api/src/models/site_config.py

@@ -51,6 +51,11 @@ class SiteConfig(UUIDPrimaryKeyMixin, TimestampMixin, Base):
     privacy_policy_url: Mapped[str | None] = mapped_column(Text, nullable=True)
     terms_url: Mapped[str | None] = mapped_column(Text, nullable=True)
 
+    # Banner default language override. When set, the banner uses this locale
+    # instead of auto-detecting from the browser (navigator.language / data-locale).
+    # Null = auto-detect (existing behaviour).
+    default_language: Mapped[str | None] = mapped_column(String(10), nullable=True)
+
     # Cookie categories shown in the banner. When NULL, inherit from the
     # cascade (site-group → org → system default of all five). An explicit
     # list overrides. ``necessary`` is always implicit and will be forced

apps/api/src/schemas/site.py

@@ -61,6 +61,7 @@ class SiteConfigCreate(BaseModel):
     banner_config: dict | None = None
     privacy_policy_url: str | None = None
     terms_url: str | None = None
+    default_language: str | None = Field(default=None, max_length=10)
     scan_schedule_cron: str | None = None
     scan_max_pages: int = Field(default=50, ge=1, le=1000)
     consent_expiry_days: int = Field(default=365, ge=1, le=730)
@@ -87,6 +88,7 @@ class SiteConfigUpdate(BaseModel):
     banner_config: dict | None = None
     privacy_policy_url: str | None = None
     terms_url: str | None = None
+    default_language: str | None = Field(default=None, max_length=10)
     scan_schedule_cron: str | None = None
     scan_max_pages: int | None = Field(default=None, ge=1, le=1000)
     consent_expiry_days: int | None = Field(default=None, ge=1, le=730)
@@ -112,6 +114,7 @@ class SiteConfigResponse(BaseModel):
     banner_config: dict | None = None
     privacy_policy_url: str | None = None
     terms_url: str | None = None
+    default_language: str | None = None
     scan_schedule_cron: str | None = None
     scan_max_pages: int = 50
     consent_expiry_days: int = 365

apps/api/src/services/config_resolver.py

@@ -148,6 +148,7 @@ def build_public_config(
         "gcm_default": resolved.get("gcm_default"),
         "shopify_privacy_enabled": resolved["shopify_privacy_enabled"],
         "banner_config": resolved.get("banner_config"),
+        "default_language": resolved.get("default_language"),
         "privacy_policy_url": resolved.get("privacy_policy_url"),
         "terms_url": resolved.get("terms_url"),
         "consent_expiry_days": resolved["consent_expiry_days"],
@@ -173,6 +174,7 @@ CONFIG_FIELDS = (
     "gcm_default",
     "shopify_privacy_enabled",
     "banner_config",
+    "default_language",
     "privacy_policy_url",
     "terms_url",
     "consent_expiry_days",