fix: locale switch crash without Referer (Sentry ADMIN-6H) + Sentry investigation doc

[spaenleh]

Fix: ADMIN-6H

POST /locale redirected with redirect(external: referrer). When the browser sends no Referer header (privacy extensions or settings, strict referrer policy), referrer is nil and Phoenix raises ArgumentError: expected :to or :external option in redirect/2. The visitor gets a 500 and the language change is lost. Sentry has 32 events since 2026-07-09, all in production.

change_locale now redirects to the referer's path and query, and falls back to / when the header is missing or the path starts with //. This also removes the open redirect to any URL in Referer.

Tests in locales_test.exs:

• no Referer → redirects to / (reproduced the Sentry stack trace before the fix)
• absolute Referer → keeps only the path and query

Doc: investigating Sentry issues

docs/agents/sentry.md, linked from AGENTS.md:

• maps Sentry URL shapes to sentry-cli commands, plus curl against the REST API for event stack traces, which sentry-cli can't show
• lists the token scopes needed (event:read, project:read)
• gives an investigation procedure that ends with a root cause pinned to a file and line at the deployed release

Our events mark every frame inApp: false, so the doc identifies our code by the lib/admin path instead.