fix(client-controller): single constructor with IHtmlLocalizer

The partial class ClientController had two constructors declared
across ClientController.cs and ClientController.Collections.cs.
ASP.NET Core DI failed to pick one at request time with:

  System.InvalidOperationException: Multiple constructors accepting
  all given argument types have been found in type
  'Yavsc.Controllers.ClientController'.

Move IHtmlLocalizer<ClientController> into the primary constructor
in ClientController.cs and drop the duplicate one in
ClientController.Collections.cs. The Collections partial now keeps
only its readonly field and action methods; the constructor and
field assignment are unified on the main file.

Also add the missing 'using Microsoft.AspNetCore.Mvc.Localization;'
to ClientController.cs so IHtmlLocalizer resolves.

src/Yavsc.Org.Tests/TestWebApplicationFactory.cs

@@ -0,0 +1,37 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Yavsc.Org.Tests;
+
+/// <summary>
+/// WebApplicationFactory-based fixture for integration tests that need
+/// to override services registered by the production <c>Program</c>.
+/// Uses the in-memory <see cref="TestServer"/> so tests can hit real
+/// HTTP endpoints without sockets or self-signed certificates.
+///
+/// Currently overrides <see cref="TestAuthPolicyProvider"/> so that
+/// <c>[Authorize("AdministratorOnly")]</c> (and any other policy
+/// requiring a role) is satisfied by sending an
+/// <c>X-Test-Role: Administrator</c> header, without a real login.
+/// </summary>
+public class TestWebApplicationFactory : WebApplicationFactory<Program>
+{
+    protected override void ConfigureWebHost(IWebHostBuilder builder)
+    {
+        // UseDevelopmentEnvironment triggers the dev signing credential
+        // path in the production startup, so we don't need a real cert
+        // to satisfy IdentityServer at boot.
+        builder.UseEnvironment("Development");
+
+        builder.ConfigureTestServices(services =>
+        {
+            // Replace the production IAuthorizationPolicyProvider with
+            // the test one. The default registered by AddAuthorization
+            // becomes irrelevant: any GetPolicyAsync call is routed here.
+            services.AddSingleton<IAuthorizationPolicyProvider, TestAuthPolicyProvider>();
+        });
+    }
+}