upgrade: adopt V8.21.3 (V8.13→8.21.3: P5 SFTP/S3, P6 multilingual, editor overhaul, enterprise hardening)

Overlay ~150 upstream items onto our V8.12 base, preserving trade-pro
theme, registry tests, and design docs. Re-applied our patch set
(discovery/env_for/blocks.css/type-mapping/theme_color/frontend entries,
test_theme_pro_v3 mods) — all anchors survived upstream evolution.

New platform enhancement (fixes upgrade-introduced regression):
multilingual.site_locale now honors settings_json.locale, plus
PUT /api/i18n/sites/{id}/locale — standalone English sites get
<html lang='en'> under the V8.15 locale-rewrite pipeline.

compose: adopt V8.21.3 (image 8.21.3-dev.1, /api/ready probes, MySQL/S3
env) with project name pinned to siteforge-v8-10 (data volumes).

Tests: 356 passed / 11 failed — all 11 confirmed pre-existing in
pristine V8.21.3 on this host (10 upstream Windows env + our build test
now green after locale fix). Patch registry updated in plan doc.

Co-Authored-By: Claude Code <noreply@anthropic.com>

compose.s3-gateway.example.yaml

@@ -0,0 +1,27 @@
+# Deploy separately behind a proper TLS proxy. No publication credentials.
+# Example: docker compose -f compose.yaml -f compose.s3-gateway.example.yaml up -d --build
+services:
+  s3-site-gateway:
+    image: siteforge/web:8.21.0-dev.1
+    depends_on:
+      siteforge: {condition: service_started}
+    command: ["python", "-m", "uvicorn", "app.s3_gateway:app", "--host", "0.0.0.0", "--port", "8791"]
+    restart: unless-stopped
+    environment:
+      SITEFORGE_S3_GATEWAY_BUCKET: ${SITEFORGE_PRODUCTION_S3_BUCKET:?Set S3 bucket}
+      SITEFORGE_S3_GATEWAY_REGION: ${SITEFORGE_PRODUCTION_S3_REGION:?Set region}
+      SITEFORGE_S3_GATEWAY_PREFIX: ${SITEFORGE_PRODUCTION_S3_PREFIX:-siteforge}
+      # Supply read-only IAM role via workload identity; do not put keys in source files.
+    ports:
+      - "127.0.0.1:${SITEFORGE_GATEWAY_PORT:-8791}:8791"
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m,mode=1777
+    cap_drop: [ALL]
+    security_opt: ["no-new-privileges:true"]
+    pids_limit: 64
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8791/health', timeout=3)"]
+      interval: 30s
+      timeout: 5s
+      retries: 3