fix(clients): reject spaces, '/', '\' and control chars in client email

Client emails containing a slash broke the path-param routes
(edit/delete/view returned 404 / "client not found"), leaving stale
records that could only be cleared with manual SQLite edits. Validate
the email on both the backend (Create + Update, which also covers the
bulk paths) and the frontend (Zod) so these characters are rejected at
save time with a clear, localized message across all 13 locales.

Closes #4695

web/service/client_email_validation_test.go

@@ -0,0 +1,32 @@
+package service
+
+import "testing"
+
+func TestValidateClientEmail(t *testing.T) {
+	valid := []string{
+		"alice",
+		"alice@example.com",
+		"user-123_test.name",
+		"имя",
+	}
+	for _, email := range valid {
+		if err := validateClientEmail(email); err != nil {
+			t.Errorf("validateClientEmail(%q) = %v, want nil", email, err)
+		}
+	}
+
+	invalid := []string{
+		"i6dui/",
+		"a/b",
+		"client with spaces",
+		"back\\slash",
+		"tab\there",
+		"new\nline",
+		"\x7fdelete",
+	}
+	for _, email := range invalid {
+		if err := validateClientEmail(email); err == nil {
+			t.Errorf("validateClientEmail(%q) = nil, want error", email)
+		}
+	}
+}