fix: collectstatic race + bump submodule for language switcher hardening

CMS entrypoint
- Wipe STATIC_ROOT manually before collectstatic instead of relying on
  --clear. Django 4.2 ManifestStaticFilesStorage races between --clear
  and the post-process pass: a deleted hashed file gets re-targeted by
  the group-id chown step and the entrypoint dies with FileNotFoundError
  on files like admin/js/vendor/select2/i18n/<lang>.<hash>.js. Doing the
  wipe out-of-band makes the two phases sequential, not concurrent.
  This was leaving the Wagtail admin assets partially deployed every
  time, which is why /admin/ login was broken.
- Add 'set -e' so future entrypoint failures actually fail the container
  instead of silently leaving services in a half-deployed state.

Submodule bump
- eafw_geomanager_web -> 3df051e (language switcher hardening: wipe
  localStorage/sessionStorage + hard reload).

Author: HillaryKoros

docker/cms/docker-entrypoint.sh

@@ -1,10 +1,21 @@
 #!/bin/bash
+set -e
 
 # migrate db
 python manage.py migrate --noinput
 
-# collect static files
-python manage.py collectstatic --clear --no-input
+# Clear the static dir BEFORE collectstatic instead of letting --clear
+# do it. Django 4.2 ManifestStaticFilesStorage races between --clear and
+# the post-process pass: a deleted hashed file gets re-targeted by the
+# group-id chown step and the entrypoint dies with FileNotFoundError on
+# files like admin/js/vendor/select2/i18n/<lang>.<hash>.js. Doing the
+# wipe out-of-band makes the two phases sequential, not concurrent.
+STATIC_ROOT_DIR="${STATIC_ROOT:-/home/app/static}"
+if [ -d "$STATIC_ROOT_DIR" ]; then
+  find "$STATIC_ROOT_DIR" -mindepth 1 -delete 2>/dev/null || true
+fi
+mkdir -p "$STATIC_ROOT_DIR"
+python manage.py collectstatic --no-input
 
 # ensure environment-variables are available for cronjob
 printenv | grep -v "no_proxy" >>/etc/environment