feat: trusted release keys setting; drop the duplicate release registration route [CI]

The panel now lets the deployer decide which release keys it trusts. The
official CI key is built in and always trusted; an own P-256 public key can be
added (off by default, the private key is rejected) so manifests signed with it
are accepted too. Removing it drops the manifests only it signed. Changes are
audited and need update.confirm.

Admin UI: System > Trust > "Trusted release keys" with a collapsible guide on
generating a key pair and signing a manifest with openssl.

Registration now has one path, POST /api/release/offer (no token, signature
verified). The admin POST /releases route, the release.publish capability and
the ci-release preset are removed.

web/admin/src/pages/CapabilityPicker.tsx

@@ -19,7 +19,6 @@ const NAMES: Record<string, [string, string]> = {
   'settings.write': ['修改设置', '站点设置、保留策略、重启计划'],
   'update.read': ['查看更新', '版本、发布清单、Backend 更新状态'],
   'update.confirm': ['确认更新', '确认 Backend 更新、请求节点更新'],
-  'release.publish': ['登记发布清单', '给 CI 用，只能做这一件事'],
   'keys.read': ['查看 API 令牌', ''],
   'keys.manage': ['管理 API 令牌', '创建、吊销；只能授予自己拥有的能力'],
   'accounts.manage': ['管理账户', '面板用户、密码'],