fix(i18n): respect Accept-Language q-values and scope middleware

Address codex review on #126:

- parseAcceptLanguage now parses q-values (default 1.0 per RFC 9110
  §12.5.4), drops q=0 (explicit rejection), and selects the
  highest-q supported language. Previously a header like
  'en;q=0.1, ar;q=1' picked en because the loop scanned in
  textual order and ignored q.
- middleware.ts now exports a matcher config that excludes
  _next/static, _next/image, /api, common static asset extensions,
  and crawl files. Asset and API responses no longer attach a
  Set-Cookie header and remain cacheable.

Typecheck still clean.

Author: mvanhorn

lib/i18n-core.ts

@@ -19,14 +19,35 @@ export function parseAcceptLanguage<T extends string>(
 ): T {
   if (!header) return fallback;
 
+  // Parse "lang;q=0.5" entries, drop q=0 (explicit rejection), and pick
+  // the highest-q supported language. RFC 9110 §12.5.4: missing q
+  // defaults to 1.0. A header like "en;q=0.1, ar;q=1" must select ar.
+  const parsed: { tag: string; primary: string; q: number }[] = [];
   for (const part of header.split(",")) {
-    const tag = part.trim().split(";")[0]?.toLowerCase();
-    const primary = tag?.split("-")[0];
+    const segments = part.trim().split(";");
+    const tag = segments[0]?.toLowerCase().trim();
+    if (!tag) continue;
+
+    let q = 1;
+    for (const param of segments.slice(1)) {
+      const [key, value] = param.split("=").map((s) => s.trim().toLowerCase());
+      if (key === "q") {
+        const num = Number(value);
+        if (!Number.isNaN(num)) q = num;
+      }
+    }
+
+    if (q <= 0) continue;
+    parsed.push({ tag, primary: tag.split("-")[0], q });
+  }
+
+  parsed.sort((a, b) => b.q - a.q);
+
+  for (const entry of parsed) {
     const match = supported.find((locale) => {
       const normalized = locale.toLowerCase();
-      return normalized === tag || normalized === primary;
+      return normalized === entry.tag || normalized === entry.primary;
     });
-
     if (match) return match;
   }
 

middleware.ts

@@ -24,3 +24,13 @@ export function middleware(request: NextRequest) {
 
   return response;
 }
+
+// Run only on routes that produce HTML or read the cookie. Skip Next.js
+// internals, the optimized image endpoint, public static assets, and API
+// routes — they don't need a locale cookie and we want their responses
+// to stay cacheable.
+export const config = {
+  matcher: [
+    "/((?!_next/static|_next/image|api|favicon.ico|robots.txt|sitemap.xml|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js|map|woff|woff2|ttf|otf)$).*)",
+  ],
+};