serve language variants under a prefix

The default locale stays at the root; every other language is the same key under
/{lang}/ (ADR-0009). /en/… is never live and redirects to the root form so the URL
space cannot fork. Lookup now takes a language and reports which one it served,
following requested → default → any rather than 404ing when a translation is
missing.

That is the second routing case, so the resolver is extracted to resolve.go and
the mux keeps one entry: URL shape is the resolver's business. A leading segment
counts as a language only when some bundle is written in it, so an unknown prefix
is a 404 rather than a stripped path — and a section may not be named after a
language in use, now recorded in content-model.md.

Because the served variant can differ from the URL requested, Page gained
.Canonical (the variant actually served) and .Alternates for hreflang. A theme
must never build a path, so both come from the engine.

Evidence: /bn/pages/about/ serves the Bengali body with lang="bn" and canonical
/bn/pages/about/; /bn/posts/hello-world/ falls back to English with canonical
/posts/hello-world/; /en/pages/about/ 301s to /pages/about/; /fr/… is 404.

internal/render/render_test.go

@@ -16,7 +16,7 @@ func TestBundleRendersMarkdownIntoTheTheme(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	out, err := r.Bundle(b)
+	out, err := r.Bundle(b, "en", []string{"en"})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -40,7 +40,7 @@ func TestBundleWithoutTitleFallsBackToKey(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	out, err := r.Bundle(b)
+	out, err := r.Bundle(b, "en", []string{"en"})
 	if err != nil {
 		t.Fatal(err)
 	}