fix(web): localize the trajectory toolbar and simplify the download

Toolbar strings route through the locale dictionary's standard t seat (the
export button no longer mixes languages in the English golden), exportLog
passes the response blob straight to the browser save instead of copying it
three times, the client id sanitizer rejects dot segments like the host one,
and the fixture stub comment no longer misattributes the 404.

packages/client/ui-trajectory/tests/export-log.spec.ts

@@ -10,11 +10,15 @@ import { sessionLogZipFilename } from '../src/client/export-log.ts'
 
 describe('sessionLogZipFilename', () => {
   it('keeps safe session ids verbatim', () => {
-    expect(sessionLogZipFilename('session-abc_1.2')).toBe('dsh-session-session-abc_1.2.zip')
+    expect(sessionLogZipFilename('session-abc_1-2')).toBe('dsh-session-session-abc_1-2.zip')
   })
 
   it('neutralizes unsafe id characters that could shape the filename', () => {
-    expect(sessionLogZipFilename('../evil')).toBe('dsh-session-.._evil.zip')
+    expect(sessionLogZipFilename('../evil')).toBe('dsh-session-___evil.zip')
     expect(sessionLogZipFilename('a/b')).toBe('dsh-session-a_b.zip')
   })
+
+  it('strips dots so a dot-only id cannot shape a dot segment', () => {
+    expect(sessionLogZipFilename('..')).toBe('dsh-session-__.zip')
+  })
 })