refactor: consolidate lang into constants, rename services to email

- Merge lang package into constants (add IsValidLang, ValidateLang, AllLangs)
- Rename internal/services to internal/email for consistency with pdf package
- Rename types to avoid redundancy: EmailService→Service, EmailConfig→Config
- Update all imports and references across codebase
- Delete internal/lang directory (functions moved to constants)

internal/middleware/browser_only.go

@@ -8,11 +8,6 @@ import (
 	c "github.com/juanatsap/cv-site/internal/constants"
 )
 
-const (
-	// Custom header that browser JavaScript must set
-	browserHeaderName  = "X-Requested-With"
-	browserHeaderValue = "XMLHttpRequest"
-)
 
 // BrowserOnly restricts endpoint access to browser requests only
 // Blocks curl, Postman, and other HTTP clients
@@ -44,8 +39,8 @@ func BrowserOnly(next http.Handler) http.Handler {
 		// For HTMX requests, check HX-Request header
 		// For fetch/XMLHttpRequest, check X-Requested-With header
 		hasHTMXHeader := r.Header.Get(c.HeaderHXRequest) == "true"
-		hasXMLHTTPHeader := r.Header.Get(browserHeaderName) == browserHeaderValue
-		hasCustomBrowserHeader := r.Header.Get("X-Browser-Request") == "true"
+		hasXMLHTTPHeader := r.Header.Get(c.HeaderXRequestedWith) == c.HeaderValueXMLHTTPRequest
+		hasCustomBrowserHeader := r.Header.Get(c.HeaderXBrowserReq) == "true"
 
 		if !hasHTMXHeader && !hasXMLHTTPHeader && !hasCustomBrowserHeader {
 			log.Printf("SECURITY: Blocked request without browser headers from IP %s", getRequestIP(r))