Admin panel sends fallback-locale=null as literal string in URL when localization is not configured

Describe the Bug

Multiple UI components send the query parameter fallback-locale=null as a literal string in the URL, even when localization is not configured in the Payload config. The string "null" is sent as text rather than omitting the parameter entirely.

This causes WAF scoring issues — systems like Cloudflare OWASP Core Ruleset detect =null as a potential type manipulation / deserialization injection attempt and add anomaly points (OWASP rules 942X).

Affected files in @payloadcms/ui/dist/:

• elements/SaveDraftButton/index.js (line 49): ?locale=${locale}&depth=0&fallback-locale=null&draft=true
• elements/Autosave/index.js (line 92): 'fallback-locale': 'null'
• elements/PublishButton/index.js (line 97): 'fallback-locale': 'null'
• elements/UnpublishButton/index.js (line 80): 'fallback-locale': 'null'
• elements/Status/index.js (lines 67, 74): fallback-locale=null
• providers/DocumentInfo/index.js (line 300): 'fallback-locale': 'null'

Expected behavior: When fallbackLocale is null or localization is not configured, the parameter should be omitted from the URL entirely instead of being sent as the literal string "null".

Link to the code that reproduces this issue

https://github.com/hrodriguez-stack/payload-multipart-bug

Reproduction Steps

This is reproducible with any Payload v3 project that does NOT have localization configured. No specific repo needed — the behavior is in the core @payloadcms/ui package.

Minimal steps without a repo:

1. pnpx create-payload-app@latest -t blank
2. Do NOT configure localization in payload.config.ts
3. Open Network tab in browser DevTools
4. Save any document
5. Observe fallback-locale=null in the request URL

Reproduction steps:

1. Create a project with pnpx create-payload-app@latest -t blank
2. Do not add localization to the payload config
3. Create any collection, add a document
4. Open browser DevTools Network tab
5. Click Save Draft or wait for Autosave
6. Observe the request URL contains fallback-locale=null as literal text
7. This triggers OWASP rule 942X (SQLi/Anomaly detection) in WAF systems that inspect query parameters

Which area(s) are affected?

area: ui, area: core

Environment Info

Binaries:
  Node: 24.14.0
  npm: 11.9.0
  Yarn: N/A
  pnpm: 9.7.0
Relevant Packages:
  payload: 3.87.0
  next: 15.3.9
  @payloadcms/db-mongodb: 3.87.0
  @payloadcms/db-postgres: 3.87.0
  @payloadcms/drizzle: 3.87.0
  @payloadcms/email-nodemailer: 3.87.0
  @payloadcms/graphql: 3.87.0
  @payloadcms/live-preview: 3.87.0
  @payloadcms/live-preview-react: 3.87.0
  @payloadcms/next/utilities: 3.87.0
  @payloadcms/payload-cloud: 3.87.0
  @payloadcms/plugin-cloud-storage: 3.87.0
  @payloadcms/plugin-form-builder: 3.87.0
  @payloadcms/plugin-nested-docs: 3.87.0
  @payloadcms/plugin-redirects: 3.87.0
  @payloadcms/plugin-search: 3.87.0
  @payloadcms/plugin-seo: 3.87.0
  @payloadcms/richtext-lexical: 3.87.0
  @payloadcms/storage-s3: 3.87.0
  @payloadcms/translations: 3.87.0
  @payloadcms/ui/shared: 3.87.0
  react: 19.1.0
  react-dom: 19.1.0
Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 25.3.0: Wed Jan 28 20:54:46 PST 2026; root:xnu-12377.91.3~2/RELEASE_ARM64_T6000
  Available memory (MB): 32768
  Available CPU cores: 10

Start by tracing the source for the affected UI entries: SaveDraftButton, Autosave, PublishButton, UnpublishButton, Status, and providers/DocumentInfo; the issue lists their built paths under @payloadcms/ui/dist/. Reproduce with a blank Payload v3 app without localization and inspect the Network tab. Done means requests no longer include fallback-locale when localization is not configured, while configured localization remains unaffected.