fix: Reject non-string locale values in getLocale

Add guard to reject non-string locale values (e.g. arrays from
query string parsing) before the regex validation check.

Author: mtrezza

src/Routers/PagesRouter.js

@@ -549,6 +549,9 @@ export class PagesRouter extends PromiseRouter {
 
     // Validate locale format to prevent path traversal; only allow
     // standard locale patterns like "en", "en-US", "de-AT", "zh-Hans-CN"
+    if (locale !== undefined && typeof locale !== 'string') {
+      return undefined;
+    }
     if (typeof locale === 'string' && !/^[a-zA-Z]{2,3}(-[a-zA-Z0-9]{2,8})*$/.test(locale)) {
       return undefined;
     }