ci: sync manifest versions to release tag; fix Cargo.lock drift

[gmcky]

The release workflow takes a version input (e.g. v1.0.6) and tags the GitHub
release with it, but the version baked into the built binaries came from
whatever was committed in the manifests. When the two drift, the release tag
and the app report different versions. It also broke CI right now: 0.1.7
landed in Cargo.toml but Cargo.lock still pinned 0.1.6, so every --locked
build (flatpak, release) aborts with "lock file needs to be updated".

Changes:

• Add scripts/set-version.mjs: rewrites the version in package.json,
  src-tauri/tauri.conf.json, src-tauri/Cargo.toml and src-tauri/Cargo.lock
  from a single vX.Y.Z argument. Validates the tag and fails if any manifest
  pattern is missing.
• release.yml: run the script from the workflow version input before every
  build job (linux, flatpak, windows), so binaries always match the release
  tag. Adds a Node setup step to the flatpak job.
• Fix the current Cargo.lock drift (0.1.6 -> 0.1.7) so --locked builds pass
  again. Going forward the script keeps the lock in step automatically.
• release.yml: skip the Discord notify step when DISCORD_WEBHOOK_URL is unset,
  so forks without the secret don't fail the release job.

Verify:

• node scripts/set-version.mjs v9.9.9 updates all four manifests
• cargo metadata --locked resolves after the lock fix
• Build and Release dispatch produces artifacts tagged with the input version

[noxygalaxy]

thanks! <3