packaging: prepare Flatpak for Flathub submission

Adds a production manifest (packaging/flatpak/flathub/) using a
pinned git source instead of the local-dir source the dev manifest
uses, so Flathub's build infrastructure can reproduce the build
independently.

Narrows the dev and production manifests' filesystem permission from
--filesystem=home to --filesystem=~/.ssh (read-write, needed for SSH
known_hosts/config) after confirming in the actual sandbox that: SSH
already works there (provided by the KDE runtime base, no extra
packaging needed), RDP needs no filesystem access at all (its
certificate trust never touched disk even before today's fix), and
QFileDialog's private-key/export pickers route through the desktop
portal rather than needing static filesystem access.

Expands AppStream metainfo with bugtracker/vcs-browser URLs, a
developer block, a releases entry, an OARS content rating, and three
screenshots (profiles view, an active SSH session, an active RDP
session) using real test-system profiles.

Adds docs/FLATHUB.md tracking overall submission readiness.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -31,6 +31,14 @@ Latest release (installers for Windows, Linux, and macOS):
 
 Profiles organized into folders, with protocol, host, and tags shown at a glance. (Sample data shown; not real hosts.)
 
+![Active SSH terminal session](docs/images/screenshot-ssh-session.png)
+
+An interactive SSH terminal session in a tab, with the event log below.
+
+![Active RDP session](docs/images/screenshot-rdp-session.png)
+
+An embedded RDP session in a tab.
+
 ## Implemented Features
 
 ### Profile Management

docs/FLATHUB.md

@@ -0,0 +1,54 @@
+# Flathub Submission Readiness
+
+Tracks OrbitHub's readiness for submission to Flathub. This is a separate
+checklist from `docs/PROGRESS.md`'s development milestones, since Flathub
+submission is an external process with its own requirements.
+
+## Status
+
+| Item | Status |
+|---|---|
+| Production manifest with pinned, reproducible git source | Done — `packaging/flatpak/flathub/org.darksingularity.OrbitHub.yml` |
+| Offline build (no network fetches during build) | Verified — no `FetchContent`/`ExternalProject`/`curl`/`wget` in CMake; all vendored deps committed in `third_party/` |
+| SSH client available inside the sandbox | Verified — provided by the `org.kde.Platform` runtime base, no packaging needed |
+| `--filesystem=home` removed | Done — narrowed to `--filesystem=~/.ssh` (read-write, needed for `known_hosts` and SSH config) |
+| SSH known-hosts trust persists with narrowed permissions | Verified in sandbox |
+| RDP works with zero filesystem permission | Verified — FreeRDP's cert trust store lives outside the sandboxed home path concerns entirely (see below) |
+| Private-key/export file pickers use the desktop portal | Uses `QFileDialog` static functions, which route through the portal when sandboxed; not yet visually confirmed interactively |
+| Current, supported KDE runtime | Verified — `6.10` (not EOL) |
+| Desktop entry validates | Verified |
+| Application icon validates | Verified — PNGs at all standard hicolor sizes, matching the real app icon |
+| MetaInfo/AppStream validates | Verified via `appstreamcli validate` (0 errors) |
+| Screenshots present | In progress |
+| Release information present | Done — `<releases>` block with `v2026.9.8` |
+| Developer/project URLs present | Done — homepage, bugtracker, vcs-browser, developer block |
+| Architecture support decided | `x86_64` only (no ARM hardware available to test FreeRDP/WinPR on aarch64) |
+| Flathub manifest linter passes | Not yet run locally — needs `sudo apt install gir1.2-appstream-1.0` for its AppStream bindings; Flathub's own CI runs this during submission review regardless |
+| AppStream linter passes | Passing (`appstreamcli validate`) |
+| Clean install works without host dependencies | Verified via local `.flatpak` bundle install and launch |
+
+## Related finding (not a packaging blocker)
+
+During permission-narrowing research, RDP certificate verification was found
+to be completely disabled (`IgnoreCertificate=TRUE`, all server certificates
+silently accepted including *changed* ones). This has been fixed separately
+in `src/rdp_session_backend.cpp` — FreeRDP's own trust-on-first-use
+certificate store is now used, matching SSH's known-hosts model. Not a
+Flathub-specific issue, but worth noting since it was found in the course of
+this work.
+
+## Explicitly out of scope for this repo
+
+- Opening the actual submission PR against `github.com/flathub/flathub` —
+  requires the maintainer's GitHub identity, done outside this repo.
+- ARM64 build/testing — no hardware available.
+- Flathub's post-acceptance developer-verification step — done via
+  Flathub's own website after acceptance, using DNS control of
+  `darksingularity.org`.
+
+## Files
+
+- Dev manifest (local iteration, `type: dir`): `packaging/flatpak/org.darksingularity.OrbitHub.yml`
+- Flathub submission manifest (pinned `type: git`): `packaging/flatpak/flathub/org.darksingularity.OrbitHub.yml`
+- AppStream metainfo: `packaging/linux/org.darksingularity.OrbitHub.metainfo.xml`
+- Desktop entry: `packaging/linux/org.darksingularity.OrbitHub.desktop`

packaging/flatpak/flathub/org.darksingularity.OrbitHub.yml

@@ -0,0 +1,25 @@
+app-id: org.darksingularity.OrbitHub
+runtime: org.kde.Platform
+runtime-version: "6.10"
+sdk: org.kde.Sdk
+command: orbithub
+only-arches:
+  - x86_64
+finish-args:
+  - --share=network
+  - --share=ipc
+  - --socket=fallback-x11
+  - --socket=wayland
+  - --device=dri
+  - --filesystem=~/.ssh
+modules:
+  - name: orbithub
+    buildsystem: cmake-ninja
+    builddir: true
+    config-opts:
+      - -DCMAKE_BUILD_TYPE=Release
+    sources:
+      - type: git
+        url: https://git.darksingularity.org/DarkSingularity/orbithub.git
+        tag: v2026.9.8
+        commit: 68214db744714f19e0dcf01c1e535afed2dab1e7

packaging/flatpak/org.darksingularity.OrbitHub.yml

@@ -9,7 +9,7 @@ finish-args:
   - --socket=fallback-x11
   - --socket=wayland
   - --device=dri
-  - --filesystem=home
+  - --filesystem=~/.ssh
 modules:
   - name: orbithub
     buildsystem: cmake-ninja

packaging/linux/org.darksingularity.OrbitHub.metainfo.xml

@@ -10,7 +10,32 @@
   </description>
   <launchable type="desktop-id">org.darksingularity.OrbitHub.desktop</launchable>
   <url type="homepage">https://git.darksingularity.org/DarkSingularity/orbithub</url>
+  <url type="bugtracker">https://git.darksingularity.org/DarkSingularity/orbithub/issues</url>
+  <url type="vcs-browser">https://git.darksingularity.org/DarkSingularity/orbithub</url>
+  <developer id="org.darksingularity">
+    <name>DarkSingularity</name>
+  </developer>
   <provides>
     <binary>orbithub</binary>
   </provides>
+  <content_rating type="oars-1.1" />
+  <screenshots>
+    <screenshot type="default">
+      <caption>Profiles organized into folders</caption>
+      <image>https://git.darksingularity.org/DarkSingularity/orbithub/raw/branch/main/docs/images/screenshot-profiles.png</image>
+    </screenshot>
+    <screenshot>
+      <caption>Active SSH terminal session</caption>
+      <image>https://git.darksingularity.org/DarkSingularity/orbithub/raw/branch/main/docs/images/screenshot-ssh-session.png</image>
+    </screenshot>
+    <screenshot>
+      <caption>Active RDP session</caption>
+      <image>https://git.darksingularity.org/DarkSingularity/orbithub/raw/branch/main/docs/images/screenshot-rdp-session.png</image>
+    </screenshot>
+  </screenshots>
+  <releases>
+    <release version="2026.9.8" date="2026-09-08">
+      <url>https://git.darksingularity.org/DarkSingularity/orbithub/releases/tag/v2026.9.8</url>
+    </release>
+  </releases>
 </component>