serve language variants under a prefix

The default locale stays at the root; every other language is the same key under
/{lang}/ (ADR-0009). /en/… is never live and redirects to the root form so the URL
space cannot fork. Lookup now takes a language and reports which one it served,
following requested → default → any rather than 404ing when a translation is
missing.

That is the second routing case, so the resolver is extracted to resolve.go and
the mux keeps one entry: URL shape is the resolver's business. A leading segment
counts as a language only when some bundle is written in it, so an unknown prefix
is a 404 rather than a stripped path — and a section may not be named after a
language in use, now recorded in content-model.md.

Because the served variant can differ from the URL requested, Page gained
.Canonical (the variant actually served) and .Alternates for hreflang. A theme
must never build a path, so both come from the engine.

Evidence: /bn/pages/about/ serves the Bengali body with lang="bn" and canonical
/bn/pages/about/; /bn/posts/hello-world/ falls back to English with canonical
/posts/hello-world/; /en/pages/about/ 301s to /pages/about/; /fr/… is 404.

internal/render/render.go

@@ -34,6 +34,17 @@ type Page struct {
 	Extra map[string]any
 	// Style is the reference theme's stylesheet, inlined so a bare site root needs no asset route.
 	Style template.CSS
+	// Canonical is the permalink of the variant actually served, which differs from the requested URL
+	// when the fallback chain supplied another language (ADR-0009).
+	Canonical string
+	// Alternates lists every language this key exists in, for hreflang.
+	Alternates []Alternate
+}
+
+// Alternate is one language a bundle exists in.
+type Alternate struct {
+	Lang string
+	URL  string
 }
 
 // Renderer holds the parsed template set and the Markdown converter. Templates are parsed once, never
@@ -61,18 +72,25 @@ func New() (*Renderer, error) {
 }
 
 // Bundle renders one bundle into a complete page.
-func (r *Renderer) Bundle(b content.Bundle) ([]byte, error) {
+//
+// served is the language actually chosen by the fallback chain, and variants every language the key
+// exists in; both feed canonical and hreflang, which a theme must not construct itself.
+func (r *Renderer) Bundle(b content.Bundle, served string, variants []string) ([]byte, error) {
 	var body bytes.Buffer
 	if err := r.md.Convert(b.Body, &body); err != nil {
 		return nil, fmt.Errorf("markdown %s: %w", b.Path, err)
 	}
 	p := Page{
-		Title: b.Title,
-		Lang:  b.Lang,
-		Key:   b.Key,
-		HTML:  template.HTML(body.String()),
-		Extra: b.Extra,
-		Style: r.style,
+		Title:     b.Title,
+		Lang:      b.Lang,
+		Key:       b.Key,
+		HTML:      template.HTML(body.String()),
+		Extra:     b.Extra,
+		Style:     r.style,
+		Canonical: content.URL(b.Key, served),
+	}
+	for _, l := range variants {
+		p.Alternates = append(p.Alternates, Alternate{Lang: l, URL: content.URL(b.Key, l)})
 	}
 	var out bytes.Buffer
 	if err := r.tmpl.ExecuteTemplate(&out, "base", p); err != nil {