feat: trusted release keys setting; drop the duplicate release registration route [CI]

The panel now lets the deployer decide which release keys it trusts. The
official CI key is built in and always trusted; an own P-256 public key can be
added (off by default, the private key is rejected) so manifests signed with it
are accepted too. Removing it drops the manifests only it signed. Changes are
audited and need update.confirm.

Admin UI: System > Trust > "Trusted release keys" with a collapsible guide on
generating a key pair and signing a manifest with openssl.

Registration now has one path, POST /api/release/offer (no token, signature
verified). The admin POST /releases route, the release.publish capability and
the ci-release preset are removed.

backend/tests/MoShiro.Backend.Tests/ReleaseOfferTests.cs

@@ -75,7 +75,7 @@ public sealed class ReleaseOfferTests
     }
 
     [Fact]
-    public async Task OfferWithAValidSignature_IsAccepted_WithoutAnyToken_AndTheAdminEndpointChecksTheSignatureToo()
+    public async Task OfferWithAValidSignature_IsAccepted_WithoutAnyToken()
     {
         long seq = TimeProvider.System.GetUtcNow().ToUnixTimeSeconds() * 1000; // backend 的 release 通道：不和别的用例抢 agent、probe 的 seq
         string manifest = $$"""{"schema":1,"component":"backend","channel":"release","image":"registry.example/moshiro/moshiro-backend","digest":"sha256:0000000000000000000000000000000000000000000000000000000000000000","tag":"dev-x","version":"0.1.1","seq":{{seq}}}""";
@@ -83,19 +83,5 @@ public sealed class ReleaseOfferTests
 
         using HttpResponseMessage offered = await anonymous.PostAsync("/api/release/offer", BackendFixture.Json(new JsonObject { ["manifest"] = manifest, ["signature"] = TestReleaseKey.Sign(manifest) }));
         Assert.Equal(HttpStatusCode.Created, offered.StatusCode);
-
-        // 管理员通道不再是不验签的口子：签名不对一样拒绝
-        string next = manifest.Replace($"\"seq\":{seq}", $"\"seq\":{seq + 1}", StringComparison.Ordinal);
-        using HttpResponseMessage forged = await _backend.Admin.PostAsync("/api/admin/releases", BackendFixture.Json(new JsonObject { ["manifest"] = next, ["signature"] = OpenSslSignature }));
-        Assert.Equal(HttpStatusCode.Forbidden, forged.StatusCode);
-    }
-
-    [Fact]
-    public async Task TheAdminEndpoint_StillNeedsTheCapability()
-    {
-        using HttpClient anonymous = _backend.NewClient();
-        using HttpResponseMessage response = await anonymous.PostAsync("/api/admin/releases", BackendFixture.Json(new JsonObject { ["manifest"] = Manifest, ["signature"] = OpenSslSignature }));
-
-        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
     }
 }