Bug

The /set-language/{lang} endpoint only sets the language cookie but doesn't update request.session["user"]["settings"]["language"].

The locale detection priority is:

1. query param
2. URL prefix (broken, see locale_selector doesn't see lang prefix after LangPrefixMiddleware strips it #1606)
3. user session ← wins over cookie
4. cookie ← this is the only thing /set-language/ updates
5. Accept-Language header

So for authenticated users, switching language via the dropdown has no effect because the session preference (set at login time) always takes priority over the cookie.

Expected

/set-language/ should also update session["user"]["settings"]["language"] so the preference actually sticks for authenticated users.

Steps to Reproduce

1. Log in (session gets language=en from user settings)
2. Switch language via /set-language/ca?current=/
3. Cookie is set to ca, but next request reads en from session
4. Language reverts to English

Filed by Claude Code.