fix(clients): reject spaces, '/', '\' and control chars in subscription ID

Like the client email, the subId is embedded directly in subscription
URLs, so the same characters break it. Validate it on the backend
(Create + Update) and the frontend (Zod), with a localized message
across all 13 locales. An empty subId stays allowed (it is then
auto-generated).

web/service/client_email_validation_test.go

@@ -30,3 +30,28 @@ func TestValidateClientEmail(t *testing.T) {
 		}
 	}
 }
+
+func TestValidateClientSubID(t *testing.T) {
+	valid := []string{
+		"",
+		"abc123",
+		"sub-id_value",
+	}
+	for _, subID := range valid {
+		if err := validateClientSubID(subID); err != nil {
+			t.Errorf("validateClientSubID(%q) = %v, want nil", subID, err)
+		}
+	}
+
+	invalid := []string{
+		"a/b",
+		"with space",
+		"back\\slash",
+		"new\nline",
+	}
+	for _, subID := range invalid {
+		if err := validateClientSubID(subID); err == nil {
+			t.Errorf("validateClientSubID(%q) = nil, want error", subID)
+		}
+	}
+}