Auto-discover locales and harden JSON config loading

- discover available locale files dynamically instead of relying on a hardcoded language list
- make config JSON decoding more defensive to avoid null-state failures on invalid or empty data
- improve startup resilience when configuration files are missing or malformed

setup.php

@@ -3,7 +3,7 @@ $config_path = __DIR__ . '/config.json';
 
 // Automatically migrate the legacy config format.
 if (file_exists($config_path)) {
-    $existing = json_decode(file_get_contents($config_path), true);
+    $existing = json_decode(file_get_contents($config_path), true) ?? [];
     if (isset($existing['epg_url']) && !isset($existing['epg_sources'])) {
         $existing['epg_sources'] = [[
             'name'    => 'Main',
@@ -22,7 +22,16 @@ if (file_exists($config_path)) {
 }
 
 $is_first_setup = !file_exists($config_path);
-$existing       = $is_first_setup ? [] : json_decode(file_get_contents($config_path), true);
+$existing       = [];
+$corrupt_config = false;
+if (!$is_first_setup) {
+    $existing = json_decode(file_get_contents($config_path), true) ?? [];
+    if (!is_array($existing)) {
+        $existing       = [];
+        $corrupt_config = true;
+        $is_first_setup = true;
+    }
+}
 $admin_key      = $existing['admin_key'] ?? null;
 
 $mode    = 'setup';