fix: fixing a word's language no longer deletes it; docs say typed words reach Wiktionary (launch checks F1, F5)

[HackTuah]

Two fixes from the automated launch checks on v1.0.0-rc.4. Every main flow passed in Firefox and Chromium (20/20 each), using the release zips. These two are the findings worth fixing before the tag.

• F1 (bug): "Another language" could delete the word. When the model answered with the same word in the same language ("Already in your list"), the new add landed on the old add's word, and retiring the old add then deleted it. The word went to Recently deleted while the popup said it was in the list. retireReplaced now keeps any word the new add landed on. The regression test in test/bg/local-mode.test.mjs re-adds a word as itself: before the fix the list was [], after it ["es:gato"]. The existing test (a real change of language removes the old word) still passes.
• F5 (docs): typed words do reach Wiktionary. The docs site and README said nothing leaves your browser for word = meaning, but for a language with word stress Kotiko looks the word up on English Wiktionary for its pronunciation, as the privacy policy already says. Those pages now say so.
• The security report now names this one code change after rc.4. It touches no security control, so the gate stays closed; the lead checked with check-security-gate.mjs --version 1.0.0.

Filed for 1.0.x instead:

• F2: Recently deleted on an open dashboard is stale in local mode;
• F3: focus is lost after the M menu;
• F4: Enter in the popup's language search does nothing;
• F6: the plain-HTTP warnings still mention the access key.

Checks: npm test 2082 pass; lint; site npm test 25/25 and npm run check; old-name; DCO.

🤖 Generated with Claude Code