feat: app manifest validator and Spanish locale stub

- Y2-02: scripts/validate-app-manifest.sh — validates community app
  manifests (YAML, required fields, trusted registry, no :latest,
  security checks, memory limits)
- Y2-03: neode-ui/src/locales/es.json — Spanish locale stub with
  common strings translated, template for other languages

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/locales/es.json

@@ -0,0 +1,39 @@
+{
+  "common": {
+    "cancel": "Cancelar",
+    "save": "Guardar",
+    "close": "Cerrar",
+    "copy": "Copiar",
+    "copied": "Copiado",
+    "copiedBang": "Copiado!",
+    "loading": "Cargando...",
+    "retry": "Reintentar",
+    "refresh": "Actualizar",
+    "install": "Instalar",
+    "installing": "Instalando...",
+    "uninstall": "Desinstalar",
+    "start": "Iniciar",
+    "stop": "Detener",
+    "restart": "Reiniciar",
+    "launch": "Abrir",
+    "starting": "Iniciando...",
+    "stopping": "Deteniendo...",
+    "send": "Enviar",
+    "sending": "Enviando...",
+    "back": "Volver",
+    "done": "Hecho",
+    "manage": "Gestionar",
+    "connect": "Conectar",
+    "connecting": "Conectando...",
+    "disconnect": "Desconectar",
+    "running": "en ejecucion",
+    "stopped": "detenido"
+  },
+  "_meta": {
+    "language": "Espanol",
+    "locale": "es",
+    "direction": "ltr",
+    "coverage": "partial",
+    "note": "Stub file — only common strings translated. Full translation needed for Y2-03."
+  }
+}