feat(flatpak): add Flatpak packaging and CI release pipeline (#271)

Adds full Flatpak support for Psysonic including:

- Flatpak manifest (org.gnome.Platform 47 + rust-stable + node20)
  with proper finish-args for MPRIS, Discord RPC, PulseAudio, Wayland/X11
- AppStream metainfo XML and .desktop entry
- In-app updater disabled at build time via VITE_PSYSONIC_FLATPAK=1
- CI job \`build-flatpak\` in release.yml: generates cargo/npm offline
  sources, patches manifest with release tag/commit, builds bundle via
  flatpak/flatpak-github-actions@v6, uploads .flatpak to GitHub release
- Release docs updated in CLAUDE.md (Flatpak bump and Flathub mirror flow)

.github/workflows/release.yml

@@ -228,6 +228,78 @@ jobs:
             \( -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" \) \
             | xargs gh release upload "app-v${VERSION}" --clobber
 
+  build-flatpak:
+    needs: create-release
+    permissions:
+      contents: write
+    runs-on: ubuntu-24.04
+    container:
+      image: bilelmoussaoui/flatpak-github-actions:gnome-47
+      options: --privileged
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: install source-generation tools
+        run: |
+          dnf install -y python3-pip python3-aiohttp
+          pip3 install --break-system-packages tomlkit
+
+      - name: install flatpak-builder-tools
+        run: |
+          git clone --depth=1 \
+            https://github.com/flatpak/flatpak-builder-tools.git \
+            /tmp/flatpak-builder-tools
+          # cargo generator: still a single script
+          # node generator: now a proper Python package, install via pip
+          pip3 install --break-system-packages \
+            /tmp/flatpak-builder-tools/node
+
+      - name: generate cargo offline sources
+        run: |
+          python3 /tmp/flatpak-builder-tools/cargo/flatpak-cargo-generator.py \
+            src-tauri/Cargo.lock -o packages/flatpak/cargo-sources.json
+
+      - name: generate npm offline sources
+        run: |
+          flatpak-node-generator npm package-lock.json \
+            -o packages/flatpak/npm-sources.json
+
+      - name: patch manifest for this release
+        env:
+          VERSION: ${{ needs.create-release.outputs.package_version }}
+        run: |
+          git config --global --add safe.directory /__w/psysonic/psysonic
+          # Dereference the release tag to get the commit it points to.
+          # ^{} peels annotated tag objects; falls back for lightweight tags.
+          COMMIT=$(git ls-remote origin "refs/tags/app-v${VERSION}^{}" | awk '{print $1}')
+          if [ -z "$COMMIT" ]; then
+            COMMIT=$(git ls-remote origin "refs/tags/app-v${VERSION}" | awk '{print $1}')
+          fi
+          sed -i \
+            -e "s|tag: app-v.*|tag: app-v${VERSION}|" \
+            -e "s|commit: PLACEHOLDER_COMMIT|commit: ${COMMIT}|" \
+            -e "s|VITE_LASTFM_API_KEY=__LASTFM_KEY__|VITE_LASTFM_API_KEY=${{ secrets.VITE_LASTFM_API_KEY }}|" \
+            -e "s|VITE_LASTFM_API_SECRET=__LASTFM_SECRET__|VITE_LASTFM_API_SECRET=${{ secrets.VITE_LASTFM_API_SECRET }}|" \
+            packages/flatpak/dev.psysonic.Psysonic.yml
+
+      - uses: flatpak/flatpak-github-actions/flatpak-builder@v6
+        with:
+          bundle: Psysonic_${{ needs.create-release.outputs.package_version }}.flatpak
+          manifest-path: packages/flatpak/dev.psysonic.Psysonic.yml
+          cache-key: flatpak-${{ github.sha }}
+
+      - name: install gh CLI
+        run: dnf install -y gh
+
+      - name: upload flatpak bundle to release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION=${{ needs.create-release.outputs.package_version }}
+          gh release upload "app-v${VERSION}" \
+            "Psysonic_${VERSION}.flatpak" \
+            --clobber
+
   # Verifies that `nix build .#psysonic` still works against the current source,
   # refreshes `nix/upstream-sources.json` (npmDepsHash) + `flake.lock`
   # (nixpkgs pin), and pushes the resulting store paths to the public Cachix