Flatpak: build from source instead of repackaging debs

- Rewrite Flatpak manifest to build from source using SDK extensions
  (node22, rust-stable) with offline cargo/npm dependency caches
- Add generate-sources.sh to produce cargo-sources.json and
  node-sources.json from lock files using flatpak-builder-tools
- Vendor Node.js, protoc, and wasm-pack as archive sources with
  SHA256 verification and per-arch support
- Add SHA256 verification to vendor-node.cjs and vendor-protoc.cjs
- Rewrite update-manifest.sh to update git tag/commit and regenerate
  dependency sources
- Update Flathub CI workflow to install generators and copy source
  files
- Remove stale plugins/faker entry from package-lock.json

package-lock.json

@@ -16062,18 +16062,6 @@
       "name": "@yaak/auth-oauth2",
       "version": "0.1.0"
     },
-    "plugins/faker": {
-      "name": "@yaak/faker",
-      "version": "1.1.1",
-      "extraneous": true,
-      "dependencies": {
-        "@faker-js/faker": "^10.1.0"
-      },
-      "devDependencies": {
-        "@types/node": "^25.0.3",
-        "typescript": "^5.9.3"
-      }
-    },
     "plugins/filter-jsonpath": {
       "name": "@yaak/filter-jsonpath",
       "version": "0.1.0",