feat: AI intent router live + TOTP repeat-auth fix

AI Intent Router:
- Wired /api/v1/ai/intent and /api/v1/ai/capabilities into app.js
- Pattern matching works offline, no API key needed
- Handles: deploy, recommend, diagnose, backup, health, list
- AI chat floating button on dashboard (🤖)
- Suggestion chips: Deploy Plex, Stream movies, Block ads, System health
- Deploy buttons in chat launch the app selector

TOTP Fix:
- secureFetch() was missing credentials: same-origin
- Session cookie was not being sent on API calls
- Added credentials: same-origin to all fetch calls
- Users no longer prompted for TOTP on every action

Nesting Guard:
- Fixed logging module path (../utils/logging not ./logging)
- Switched to console.log to avoid module export mismatch

MCP Server:
- 551-line JSON-RPC server ready at src/mcp/mcp-server.js
- Configurable via DASHCADDY_URL + DASHCADDY_API_KEY env vars

status/js/language-selector.js

@@ -18,7 +18,7 @@
   const CONFIG_ENDPOINT = '/api/v1/config';
 
   const LANGUAGES = [
-    { code: 'en', flag: '🇬🇧', label: 'English' },
+    { code: 'en', flag: '🇺🇸', label: 'English' },
     { code: 'es', flag: '🇪🇸', label: 'Español' },
     { code: 'zh', flag: '🇨🇳', label: '中文' },
     { code: 'ar', flag: '🇸🇦', label: 'العربية' },