securing translation endpoint

common.php

@@ -1959,6 +1959,58 @@ function qdb_build_app_translations_map(PDO $pdo): array {
     return $result;
 }
 
+/**
+ * Keys safe to expose without auth (login screen + auth help only).
+ */
+function qdb_is_public_login_translation_key(string $key): bool {
+    if (str_starts_with($key, 'auth_') || str_starts_with($key, 'help_auth_')) {
+        return true;
+    }
+    if (str_starts_with($key, 'password_rule_')) {
+        return true;
+    }
+    if (preg_match('/^language_(german|english|de|en)$/i', $key) === 1) {
+        return true;
+    }
+    static $exact = [
+        'username_hint',
+        'password_hint',
+        'new_password_hint',
+        'confirm_password_hint',
+        'login_btn',
+        'save_password_btn',
+        'exit_btn',
+        'language',
+        'please_username_password',
+        'login_failed_with_reason',
+        'login_required',
+        'passwords_dont_match',
+        'password_needs_prefix',
+        'password_too_short',
+    ];
+    return in_array($key, $exact, true);
+}
+
+/**
+ * Public subset of app UI strings for the login screen (auth + help_auth).
+ * @return array<string, array<string, string>>
+ */
+function qdb_build_public_login_translations_map(PDO $pdo): array {
+    $full = qdb_build_app_translations_map($pdo);
+    $filtered = [];
+    foreach ($full as $lang => $strings) {
+        if (!is_array($strings)) {
+            continue;
+        }
+        foreach ($strings as $key => $text) {
+            if (qdb_is_public_login_translation_key((string)$key)) {
+                $filtered[$lang][(string)$key] = (string)$text;
+            }
+        }
+    }
+    return $filtered;
+}
+
 /**
  * Flat language -> stringKey -> text map for one questionnaire (questions, options, config strings).
  * Excludes keys from the global app UI catalog.