feat: structure preserving uploads for manual submissions

[sgfost]

Manual submissions no longer have an enforced dir structure (docs/, code/, etc). Instead using the category manifest introduced with

ui/ux changes

• drag-and-drop upload area replaces the four per-category forms, with a single progress bar
• category guidance tabs replace the old paragraph about folder layout

back end

• added CodebaseRelease.category_manifest field
• ImportedReleaseSyncState.category_manifest is deprecated
• save() no longer writes category_manifest, so a stale save can't overwrite a newer upload or category change
• Archives are unpacked with their paths unchanged. Uploads with path traversal or symlinks are rejected. RAR is no longer supported (doubt anyone ever used this)
• sip/data/ is now the source of truth and is edited directly, rather than going through originals for manual submissions
  • this matches how the github import flow works (we just skip the originals/ archive-preserving stage since archives are unpacked directly)
  • edits work on a copy of the SIP while holding a row lock, then swap it in (failed edit leaves the existing package unchanged)
  • originals/ are left untouched for provenance

DATA MIGRATION

./manage.py backfill_category_manifests

The backfill fills in only null manifests and is safe to re-run. Imported releases copy their existing manifest. Manual releases get categories from each file's top-level folder in sip/data/