fix(updater): manifest-based stale-file cleanup + cache clearing for v2→v3 (#659)

The v2 self-updater only overlays new files (copyFiles) and never removes
files a release deleted; the one removal path (deleted_files) is not even
sent by the web UI. A major upgrade (v2 → v3) removes thousands of files,
so overlay-only leaves a broken hybrid, and stale bootstrap/cache config +
package-discovery survive and break the new boot.

Backport v3's manifest allow-list approach into this final v2 release:

- Updater::cleanStaleFiles(?string $basePath): delete every file under the
  install not listed in the release's manifest.json, except the configured
  update_protected_paths. No manifest present → safe no-op (v2→v2 updates).
- Updater::clearCompiledCaches(): wipe bootstrap/cache/*.php and compiled
  views so the freshly copied release re-reads config and re-runs package
  discovery. Called at the end of copyFiles() — the last point that runs as
  the currently-installed code before the new release boots, and necessary
  because bootstrap/cache is itself a protected path.
- DeleteFilesController + UpdateCommand: when manifest.json is present, run
  cleanStaleFiles(); otherwise fall back to the legacy deleted_files list.
  No route or frontend change — both already call the delete step between
  copy and migrate.
- config/invoiceshelf.php: add update_protected_paths (.env, storage,
  vendor, node_modules, Modules, public/storage, .git, bootstrap/cache,
  manifest.json).

The v3 release zip already ships manifest.json (built by its make dist), so
a v2 instance running this updater cleans itself up correctly on upgrade.

Tested: tests/Unit/UpdaterTest.php covers stale removal, protected-path and
manifest preservation, empty-dir pruning, no-manifest no-op, and invalid
manifest. Full suite green.

app/Console/Commands/UpdateCommand.php

@@ -79,10 +79,8 @@ class UpdateCommand extends Command
             return;
         }
 
-        if (isset($this->response->deleted_files) && ! empty($this->response->deleted_files)) {
-            if (! $this->deleteFiles($this->response->deleted_files)) {
-                return;
-            }
+        if (! $this->cleanFiles()) {
+            return;
         }
 
         if (! $this->migrateUpdate()) {
@@ -194,12 +192,19 @@ class UpdateCommand extends Command
         return true;
     }
 
-    public function deleteFiles($files)
+    public function cleanFiles()
     {
-        $this->info('Deleting unused old files...');
-
         try {
-            Updater::deleteFiles($files);
+            // When the release ships a manifest.json (e.g. v3), remove every stale file
+            // not listed in it. Otherwise fall back to the explicit deleted_files list
+            // for same-line updates.
+            if (File::exists(base_path('manifest.json'))) {
+                $this->info('Cleaning stale files...');
+                Updater::cleanStaleFiles();
+            } elseif (isset($this->response->deleted_files) && ! empty($this->response->deleted_files)) {
+                $this->info('Deleting unused old files...');
+                Updater::deleteFiles($this->response->deleted_files);
+            }
         } catch (\Exception $e) {
             $this->error($e->getMessage());