chore(flatpak): refresh generated sources

[github-actions]

Automated monthly refresh of the offline Flatpak source manifests.

• cargo-sources.json follows src-tauri/Cargo.lock exactly.
• node-sources.json + package-lock.json re-resolve package.json
  against the npm registry, so this also bumps transitive frontend
  dependencies for the Flathub build only — the app itself is
  built from bun.lock, the Flatpak sandbox runs npm ci --offline.

packaging/flatpak/check-sources.py passed in the generating run,
and the commit is signed (created through the Git Data API) so the
required_signatures rule doesn't block the merge.

⚠️ Opened with GITHUB_TOKEN, which by design doesn't start workflow
runs — CI has not run on this PR, and the ruleset requires code
scanning to pass. Close and reopen the PR to kick everything off, or
configure the APP_ID / APP_PRIVATE_KEY secrets so future runs open
the PR as a GitHub App and CI fires on its own.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3833dd3b-5bd3-4dbc-b034-a720f48c633d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}