[rkorszun]

Fixes #259

Summary

GET /api/public/forms/:id no longer returns the creator-chosen language on 403 for a non-public form. That field was a small metadata leak after #250.

The respondent UI still localizes the closed/error message: it uses language when the API sends it (public-but-inactive 403), otherwise it maps the browser locale (pl-PL → pl, en-GB → en-US) and falls back to en-US.

Root cause

FormsService.findPublicForm threw ForbiddenException({ message, language }) for !form.isPublic, so Nest serialized language on an unauthenticated 403.

Fix

• Non-public 403: generic ForbiddenException('This form is not public') — no language.
• Public-but-inactive 403: still includes language (the form was already public).
• Client: detectBrowserLanguage() for 403/404/load errors when the body has no language.

Tests

• Server unit: non-public 403 has no language; inactive public 403 still has it.
• Client: browser locale mapping; generic 403 with navigator.language = pl-PL shows Polish formClosed.
• E2E: non-public GET returns 403 without language.

Local results

Check	Result
pnpm --filter server test	53 suites, 292 passed, 1 skipped
pnpm --filter client test	9 files, 49 passed
pnpm --filter client exec tsc --noEmit	passed

Do not merge. Draft until CI is green.