fix(i18n): ForwardProxy ACL-Labels + Diagnostics-Output vollständig übersetzt

- ForwardProxy: ACL_TYPE_KEYS-Array + t('fwd.aclTypes.*') statt
  hartkodierter gemischter DE/EN-Labels; action-Select und
  value-Placeholder ebenso via t()
- Diagnostics: '(kein Output)' → t('diag.noOutput') — war einzige
  sichtbare deutsche Konstante außerhalb t()
- en/de common.json: fwd.aclTypes.*, fwd.actions.*, fwd.valuePlaceholder,
  diag.noOutput hinzugefügt

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

management-ui/src/i18n/locales/en/common.json

@@ -881,6 +881,7 @@
     "aclType": "Type",
     "aclTypeExtra": "What Squid matches (source, domain, port, …).",
     "value": "Value",
+    "valuePlaceholder": ".example.com    or    10.10.20.0/24    or    443",
     "valueExtra": "Format depends on type — IPs/CIDRs for src/dst, domain with leading dot for dstdomain (.example.com also matches sub.example.com), regex for *_regex types.",
     "action": "Action",
     "priority": "Priority",
@@ -890,7 +891,26 @@
     "edit": "Edit ACL",
     "deleteConfirm": "Really delete ACL {{name}}?",
     "emptyTitle": "No forward-proxy ACLs yet.",
-    "emptyDesc": "Default with no ACLs: only localnet (10/8, 172.16/12, 192.168/16) is allowed out. Add an ACL to selectively allow or block specific domains/IPs/ports."
+    "emptyDesc": "Default with no ACLs: only localnet (10/8, 172.16/12, 192.168/16) is allowed out. Add an ACL to selectively allow or block specific domains/IPs/ports.",
+    "actions": {
+      "allow": "allow — permit access",
+      "deny":  "deny  — block access"
+    },
+    "aclTypes": {
+      "src":           "src — source IP/CIDR",
+      "dst":           "dst — destination IP/CIDR",
+      "dstdomain":     "dstdomain — destination domain (exact)",
+      "srcdomain":     "srcdomain — source domain (rDNS)",
+      "port":          "port — destination port",
+      "proto":         "proto — http/https/ftp/...",
+      "method":        "method — GET/POST/CONNECT/...",
+      "time":          "time — weekday/time range",
+      "url_regex":     "url_regex — full URL regex",
+      "urlpath_regex": "urlpath_regex — URL path regex",
+      "dstdom_regex":  "dstdom_regex — destination domain regex",
+      "srcdom_regex":  "srcdom_regex — source domain regex",
+      "browser":       "browser — User-Agent regex"
+    }
   },
   "common": {
     "yes": "Yes",
@@ -1055,7 +1075,8 @@
     "curl": { "intro": "HTTPS probe with -IsSv: TLS handshake details + headers. Does NOT follow redirects." },
     "tcp": { "intro": "Pure TCP connect (no I/O). Ideal to verify a backend port is reachable." },
     "securityTitle": "Security note",
-    "securityDesc": "Endpoints are behind admin auth. Targets are validated against a strict allow-list (no shell metachars). curl is restricted to http(s) — no file:// / smb:// / data://."
+    "securityDesc": "Endpoints are behind admin auth. Targets are validated against a strict allow-list (no shell metachars). curl is restricted to http(s) — no file:// / smb:// / data://.",
+    "noOutput": "(no output)"
   },
   "backups": {
     "title": "Backups",