chore(flatpak): refresh generated sources

[github-actions]

Automated monthly refresh of the offline Flatpak source manifests.

• cargo-sources.json follows src-tauri/Cargo.lock exactly.
• node-sources.json + package-lock.json re-resolve package.json
  against the npm registry, so this also bumps transitive frontend
  dependencies for the Flathub build only — the app itself is
  built from bun.lock, the Flatpak sandbox runs npm ci --offline.

packaging/flatpak/check-sources.py passed in the generating run,
and the commit is signed (created through the Git Data API) so the
required_signatures rule doesn't block the merge.

⚠️ Opened with GITHUB_TOKEN, which by design doesn't start workflow
runs — CI has not run on this PR, and the ruleset requires code
scanning to pass. Close and reopen the PR to kick everything off, or
configure the APP_ID / APP_PRIVATE_KEY secrets so future runs open
the PR as a GitHub App and CI fires on its own.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: InstaZDLL/WaveFlow/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 7821f0be-93d3-4104-a34f-6a9ff9c2e071

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}