fix(portal-shell): catch-all route prevents NG04002 on /fr in dev mode

Reproducer: `nx serve portal-shell` (source-locale dev server, no
`--localize`), open the home page, click the locale switcher's
"Français" entry. The switcher rewrites the URL to `/fr/` and
hard-refreshes; the Angular CLI dev server applies its SPA fallback
and serves the same source `index.html` for every path. The source
bundle boots with `<base href="/">`, the router tries to match
`/fr/` and finds no route → `NG04002: Cannot match any routes.
URL Segment: 'fr'` in the bootstrap promise rejection.

Fix: add a `{ path: '**', redirectTo: '' }` catch-all so unknown
paths bounce to home gracefully. In production this is a no-op
because each locale ships with its own `<base href="/{locale}/">`
and the locale segment is stripped before route matching — `/fr/foo`
hits the bundle's `foo` route, not the wildcard. The route also
serves as a defensive 404-to-home for any future bad URL in prod.

The locale switcher's actual limitation in dev (no per-locale
bundle, switching can only land on the source locale) stands; this
just turns the ugly error into a silent bounce so the dev iteration
is not interrupted.

apps/portal-shell/src/app/app.routes.ts

@@ -31,4 +31,16 @@ export const appRoutes: Route[] = [
     redirectTo: 'accessibility',
     pathMatch: 'full',
   },
+  // Catch-all. In production each locale ships with its own
+  // `<base href="/{locale}/">`, so the router never actually sees
+  // the locale segment — `/fr/foo` is normalised to `foo` before
+  // route matching, and unknown paths land here for a graceful
+  // bounce to home. In dev (`nx serve`) the dev server serves the
+  // source bundle for any URL, including `/fr/...`; without this
+  // fallback the router throws NG04002 trying to match `fr` as a
+  // segment.
+  {
+    path: '**',
+    redirectTo: '',
+  },
 ];