Resolve Console UI, download, and release validation backlog

[Vonng]

Console buffered multi-selection ZIPs in browser memory, lost keyboard names in responsive layouts, and could fail on malformed routes or stored preferences. This change streams ZIPs to a cancellable file writer with a native browser download fallback, localizes accessible controls and recovery screens, and adds regressions against production assets. Native downloads check authenticated sessions before submission and surface readable or blocked server errors; queued save-dialog cancellation settles immediately.

Release validation pins Actions and tools, verifies the Firefox archive by SHA-512, normalizes timestamps and SPDX identifiers, compares independent rebuilds and source-container assets, and prepares keyless checksum/image signatures and provenance. Stable-image promotion uses explicit repository context and verifies the published release and anonymous registry access before advancing latest.

Packages preserve operator configuration and state and use a bounded systemd service with an explicit certificate directory. Upgrades with certificates in the old home-based directory print the required action before restart and preserve the files and symlinks. Operators can keep that path through CONSOLE_OPTS or follow the migration guide shipped at /usr/share/doc/silo-console/service.md. Lifecycle tests seed private certificates before upgrade, preserve their hashes, apply the documented path override, and verify TLS with the same certificate.

The final tree retains main's dedicated admin:ChangeMyPassword capability and its migration/rollback guidance, together with the selected upstream SDK and maintained package/client commits. Embedded assets are regenerated from the combined source. The lockfile keeps the already-patched smol-toml 1.8.0.

Closes #26, closes #28, closes #29, closes #30, closes #31, closes #33, closes #35.
Refs #32 and #34; their external acceptance remains open below.

Validation for 153f48fb5f80ca160f1acc5181a3d167bc951f5a:

• Local Go API/pkg tests passed, including the five password/user-administration capability cases.
• All 251 frontend unit cases and 24 Chromium production-browser cases passed with retries disabled. Browser coverage includes the four password-capability/identity-provider cases, native and streaming ZIP failure/cancellation paths, recovery, and English/Chinese desktop/mobile accessibility.
• TypeScript and production assets, immutable dependency install, formatting, Knip/source guards, high-severity frontend audit, CREDITS, the README replacement/embedder checks and dependency structure checks passed.
• All 38 checks passed: full CI matrix and vulnerability checks. All 301 Playwright cases passed on their first attempt, with no flaky retries.
• CI built PR merge commit 9b0af0ff6ec5796a4c9b19d874d5b46756d1a909; its tree SHA exactly matches the head. Artifact verification covered six platform binaries, six bundles, nine packages and both container architectures. Source-container metadata and frontend assets matched the release inputs, and two independent rebuilds reproduced the complete checksum manifest including all sixteen SPDX SBOMs.
• All six DEB/RPM/APK fresh-install and checksum-verified v2.4.0 upgrade/removal scenarios passed. Systemd package scenarios also verified bounded stop behavior, certificate ownership, the legacy-directory warning and explicit path override, and TLS startup using the preserved certificates.

The existing history-navigation flake and low-priority progress, native filename and final-file-commit cancellation observations remain follow-ups. No assertion was removed or weakened.

External acceptance for #32/#34 remains separate: an authorized tagged release must exercise GitHub OIDC signing/provenance and signed-image promotion, and GHCR anonymous access plus the first real latest promotion must succeed. The dependency release record also continues to block actual release until silo-pkg v3.13.4 is published. This PR does not publish a tag, release or image, or change package visibility.