fix(cms): nl/pt/ru i18n + gate external_url in public response

Two follow-ups to PR #372 (external-URL toggle for imprint /
privacy CMS pages):

1. **i18n.** PR #372 added 6 new `cms.*` keys to the en + de
   locales but the project ships 5 locales total. Adds the missing
   nl / pt / ru translations so the admin CMS page renders in the
   active language for those users instead of falling back to
   English literals next to the German/Dutch/Portuguese/Russian
   surrounding strings.

2. **API shape.** `publicCMS.js` returned `external_url`
   unconditionally — even when `use_external_url` is false the URL
   value was still emitted in the public response. The frontend
   correctly gated on both flags so it worked, but the API surface
   was leaking a value the admin had explicitly disabled. The
   value still lives in the DB (so the toggle can be flipped back
   on without losing it), but the public endpoint now returns
   `null` whenever the toggle is off.

   Note: kept the existing `logo_url` shape unchanged. Its semantics
   are different — null means "fall back to global branding" and
   consumers rely on always having the field, so emitting it
   unconditionally is intentional there.

No frontend change needed: both `GalleryLayout` and `LegalPage`
already gate on `use_external_url && external_url`, so the
short-circuit handles `external_url: null` correctly.

backend/src/routes/publicCMS.js

@@ -27,9 +27,12 @@ router.get('/pages/:slug', async (req, res) => {
       logo_url: page.logo_url || null,
       // Per-page external-URL override. When use_external_url is true and
       // external_url is set, consumers should redirect / link out instead
-      // of rendering the internal title/content.
+      // of rendering the internal title/content. external_url is gated by
+      // use_external_url so the public response never exposes a URL the
+      // admin has saved-but-disabled (the value stays in the DB so the
+      // toggle can be flipped back on, but it shouldn't leak via the API).
       use_external_url: !!page.use_external_url,
-      external_url: page.external_url || null,
+      external_url: page.use_external_url && page.external_url ? page.external_url : null,
       updated_at: page.updated_at
     });
   } catch (error) {