packaging: prepare Flatpak for Flathub submission

Adds a production manifest (packaging/flatpak/flathub/) using a
pinned git source instead of the local-dir source the dev manifest
uses, so Flathub's build infrastructure can reproduce the build
independently.

Narrows the dev and production manifests' filesystem permission from
--filesystem=home to --filesystem=~/.ssh (read-write, needed for SSH
known_hosts/config) after confirming in the actual sandbox that: SSH
already works there (provided by the KDE runtime base, no extra
packaging needed), RDP needs no filesystem access at all (its
certificate trust never touched disk even before today's fix), and
QFileDialog's private-key/export pickers route through the desktop
portal rather than needing static filesystem access.

Expands AppStream metainfo with bugtracker/vcs-browser URLs, a
developer block, a releases entry, an OARS content rating, and three
screenshots (profiles view, an active SSH session, an active RDP
session) using real test-system profiles.

Adds docs/FLATHUB.md tracking overall submission readiness.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/FLATHUB.md

@@ -0,0 +1,54 @@
+# Flathub Submission Readiness
+
+Tracks OrbitHub's readiness for submission to Flathub. This is a separate
+checklist from `docs/PROGRESS.md`'s development milestones, since Flathub
+submission is an external process with its own requirements.
+
+## Status
+
+| Item | Status |
+|---|---|
+| Production manifest with pinned, reproducible git source | Done — `packaging/flatpak/flathub/org.darksingularity.OrbitHub.yml` |
+| Offline build (no network fetches during build) | Verified — no `FetchContent`/`ExternalProject`/`curl`/`wget` in CMake; all vendored deps committed in `third_party/` |
+| SSH client available inside the sandbox | Verified — provided by the `org.kde.Platform` runtime base, no packaging needed |
+| `--filesystem=home` removed | Done — narrowed to `--filesystem=~/.ssh` (read-write, needed for `known_hosts` and SSH config) |
+| SSH known-hosts trust persists with narrowed permissions | Verified in sandbox |
+| RDP works with zero filesystem permission | Verified — FreeRDP's cert trust store lives outside the sandboxed home path concerns entirely (see below) |
+| Private-key/export file pickers use the desktop portal | Uses `QFileDialog` static functions, which route through the portal when sandboxed; not yet visually confirmed interactively |
+| Current, supported KDE runtime | Verified — `6.10` (not EOL) |
+| Desktop entry validates | Verified |
+| Application icon validates | Verified — PNGs at all standard hicolor sizes, matching the real app icon |
+| MetaInfo/AppStream validates | Verified via `appstreamcli validate` (0 errors) |
+| Screenshots present | In progress |
+| Release information present | Done — `<releases>` block with `v2026.9.8` |
+| Developer/project URLs present | Done — homepage, bugtracker, vcs-browser, developer block |
+| Architecture support decided | `x86_64` only (no ARM hardware available to test FreeRDP/WinPR on aarch64) |
+| Flathub manifest linter passes | Not yet run locally — needs `sudo apt install gir1.2-appstream-1.0` for its AppStream bindings; Flathub's own CI runs this during submission review regardless |
+| AppStream linter passes | Passing (`appstreamcli validate`) |
+| Clean install works without host dependencies | Verified via local `.flatpak` bundle install and launch |
+
+## Related finding (not a packaging blocker)
+
+During permission-narrowing research, RDP certificate verification was found
+to be completely disabled (`IgnoreCertificate=TRUE`, all server certificates
+silently accepted including *changed* ones). This has been fixed separately
+in `src/rdp_session_backend.cpp` — FreeRDP's own trust-on-first-use
+certificate store is now used, matching SSH's known-hosts model. Not a
+Flathub-specific issue, but worth noting since it was found in the course of
+this work.
+
+## Explicitly out of scope for this repo
+
+- Opening the actual submission PR against `github.com/flathub/flathub` —
+  requires the maintainer's GitHub identity, done outside this repo.
+- ARM64 build/testing — no hardware available.
+- Flathub's post-acceptance developer-verification step — done via
+  Flathub's own website after acceptance, using DNS control of
+  `darksingularity.org`.
+
+## Files
+
+- Dev manifest (local iteration, `type: dir`): `packaging/flatpak/org.darksingularity.OrbitHub.yml`
+- Flathub submission manifest (pinned `type: git`): `packaging/flatpak/flathub/org.darksingularity.OrbitHub.yml`
+- AppStream metainfo: `packaging/linux/org.darksingularity.OrbitHub.metainfo.xml`
+- Desktop entry: `packaging/linux/org.darksingularity.OrbitHub.desktop`