Audit against the Piwigo plugin conventions, and the fixes it turned up.

New: French (fr_FR) translation, and a pwg.pdfdup.setConfig web-service
method that the settings page now saves through over AJAX (render-only
admin page, shared pdfdup_conf_clamp() validation).

Fixes: unescaped photo/author/album names in the review templates,
htmlspecialchars() flags in the public volume strip, Ghostscript running
without its sandbox, WCAG AA contrast on both admin themes, and SQL
escaping moved to the point of interpolation.