Replace deleted_files with manifest-based updater cleanup, add release workflow

- Add manifest.json generation script (scripts/generate-manifest.php)
- Add Updater::cleanStaleFiles() that removes files not in manifest
- Add /api/v1/update/clean endpoint with backward compatibility
- Add configurable update_protected_paths in config/invoiceshelf.php
- Update frontend to use clean step instead of delete step
- Add GitHub Actions release workflow triggered on version tags
- Add .github/release.yml for auto-generated changelog categories
- Update Makefile to include manifest generation and scripts directory

Backport from v3.0 (e6452946). Adapted for master's existing structure: master uses one-controller-per-action under app/Http/Controllers/V1/Admin/Update/, so the new endpoint is implemented as a dedicated CleanFilesController matching the existing DeleteFilesController/CopyFilesController/etc. pattern instead of v3.0's unified UpdateController. The legacy /update/delete route and DeleteFilesController are retained for compatibility — only the frontend (resources/scripts/admin/views/settings/UpdateAppSetting.vue) is updated to call /update/clean. Updater service lives at app/Space/Updater.php on master (not yet refactored to app/Services/Update/Updater.php like v3.0).

app/Http/Controllers/V1/Admin/Update/CleanFilesController.php

@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Http\Controllers\V1\Admin\Update;
+
+use App\Http\Controllers\Controller;
+use App\Space\Updater;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+
+class CleanFilesController extends Controller
+{
+    /**
+     * Handle the incoming request.
+     *
+     * Removes any file that does not appear in the release manifest.json,
+     * replacing the legacy hardcoded deleted_files list. Falls back to the
+     * legacy deleteFiles() behaviour when the request still ships a
+     * deleted_files payload (backward compatibility for older release
+     * packages built before the manifest was introduced).
+     *
+     * @return Response
+     */
+    public function __invoke(Request $request)
+    {
+        if ((! $request->user()) || (! $request->user()->isOwner())) {
+            return response()->json([
+                'success' => false,
+                'message' => 'You are not allowed to update this app.',
+            ], 401);
+        }
+
+        // Backward compatibility: a release package built before the manifest
+        // was introduced may still ship a deleted_files list. Honour it.
+        if (isset($request->deleted_files) && ! empty($request->deleted_files)) {
+            Updater::deleteFiles($request->deleted_files);
+        }
+
+        $result = Updater::cleanStaleFiles();
+
+        return response()->json($result);
+    }
+}