fix: Phase 2 QA — all 25 remaining HIGH/MEDIUM/LOW issues

HIGH fixes (7):
- H1: VNCdirectory admin i18n — 30+ translation keys added
- H2: handleSave try/catch with error toast
- H3: Free/busy accountId scoping
- H4: cancelEventBookings filter by eventId
- H5: Resource picker static apiFetch import
- H6: Sharing-store toast messages via lastMessage state
- H7: roleLabel for all resource types

MEDIUM fixes (11):
- M1: identitySignatureMap cleanup on delete
- M2: Now-line relative positioning
- M3: Radial menu disabled item keyboard nav
- M4: Radial menu stable event listener via refs
- M5: cancelBooking error on missing booking
- M6: PasswordRow isMasked state flag
- M7: Extract shared rights into lib/sharing-rights.ts
- M8: VNCtalk client server-side guard
- M9: Collabora configManager instead of process.env
- M10: CONFIG_ENV_MAP VNCdirectory fields
- M11: SENSITIVE_CONFIG_KEYS field name unification

LOW fixes (7):
- L1-L3: Unused imports removed
- L4: aria-labels on close, clear, search, spinner
- L5-L7: Comments for intentional patterns, null guard

locales/en/common.json

@@ -3424,5 +3424,71 @@
       "alignment": "Alignment",
       "font_size": "Font Size"
     }
+  },
+  "admin": {
+    "vncdirectory": {
+      "title": "VNCdirectory",
+      "description": "Centralized identity and directory integration (SAML, LDAP, 2FA)",
+      "loading": "Loading...",
+      "save": "Save configuration",
+      "saving": "Saving...",
+      "saved": "VNCdirectory configuration saved.",
+      "save_error": "Failed to save",
+      "enable_section": "Enable VNCdirectory Integration",
+      "enabled": "Enabled",
+      "enabled_description": "Turn on VNCdirectory integration for identity management, SSO, and directory services",
+      "connection": "Connection",
+      "url": "VNCdirectory URL",
+      "url_placeholder": "https://vncdirectory.example.com",
+      "api_key": "API Key",
+      "api_key_placeholder": "Enter API key",
+      "saml": "SAML / Identity Provider",
+      "saml_enabled": "SAML Enabled",
+      "saml_enabled_description": "Enable SAML single sign-on via VNCdirectory",
+      "idp_url": "Identity Provider URL",
+      "idp_url_placeholder": "https://idp.example.com/saml2/idp",
+      "issuer": "Issuer Name (Entity ID)",
+      "issuer_placeholder": "urn:example:vncmail",
+      "sp_cert": "Service Provider Certificate (X.509)",
+      "sp_cert_placeholder": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
+      "ldap": "LDAP Directory",
+      "ldap_enabled": "LDAP Enabled",
+      "ldap_enabled_description": "Query user directory via LDAP for contact lookups and authentication",
+      "ldap_uri": "LDAP Server URI",
+      "ldap_uri_placeholder": "ldaps://ldap.example.com:636",
+      "bind_dn": "Bind DN",
+      "bind_dn_placeholder": "cn=readonly,dc=example,dc=com",
+      "bind_password": "Bind Password",
+      "bind_password_placeholder": "Enter LDAP bind password",
+      "search_base": "Search Base",
+      "search_base_placeholder": "ou=users,dc=example,dc=com",
+      "ldap_type": "LDAP Type",
+      "ldap_type_openldap": "OpenLDAP",
+      "ldap_type_msad": "Microsoft Active Directory",
+      "auth_section": "Authentication",
+      "require_2fa": "Enforce 2FA/TOTP",
+      "require_2fa_description": "Require two-factor authentication for all users",
+      "oidc_section": "OpenID Connect (OIDC)",
+      "oidc_section_description": "Enable OIDC login alongside or instead of SAML",
+      "oidc_client_id": "OIDC Client ID",
+      "oidc_client_id_placeholder": "vncmail-client",
+      "oidc_discovery_url": "OIDC Discovery URL",
+      "oidc_discovery_url_placeholder": "https://idp.example.com/.well-known/openid-configuration",
+      "session_ttl": "Session TTL (seconds)",
+      "session_ttl_description": "How long SSO sessions remain valid. Default: 8 hours (28800)",
+      "federated": "Federated Applications",
+      "federated_description": "Configure SSO redirect URLs for other VNC applications. Users signed into one app will be transparently authenticated when navigating to another.",
+      "add_app": "Add federated app",
+      "app_name_placeholder": "App name (e.g. vnctalk)",
+      "app_url_placeholder": "https://vnc.example.com/auth/sso",
+      "remove_app": "Remove {name}",
+      "add": "Add",
+      "cancel": "Cancel",
+      "app_name_error": "Enter an application name",
+      "app_name_format_error": "Name must contain only letters, numbers, hyphens, and underscores",
+      "app_exists_error": "An app with this name already exists",
+      "app_url_error": "Enter an SSO URL",
+      "saved_password_hint": "Saved - type to replace"
+    }
   }
 }