Add explicit client/server side field to manifest

Bake each file's "side" (client / server / both) into manifest.json at
build time so both the launcher and the server filter deterministically
and offline. This replaces the launcher's previous "download everything"
default and lets the server short-circuit its runtime Modrinth lookup
when a file already has an authoritative tag.

Schema:
- ManifestFile.Side: "client" | "server" | "both" (null = "both" for
  backward compat with manifests pre-dating this field)
- Files marked "both" omit the field entirely to keep the JSON tight

Code changes:
- launcher Manifest.cs + ManifestSyncService: filter out "server" files
  in both the prune+download path and FindMissingFiles
- server Manifest.cs + ManifestSync: drop "client" files outright; only
  fall back to the existing runtime Modrinth lookup for files with no
  explicit side (legacy/un-tagged mods stay protected)
- server LockedMod: side field propagates into manifest at build time
- scripts/Build-Pack.ps1: propagate side from lockfile to manifest
- scripts/Bootstrap-Sides.ps1: one-off populator; queries Modrinth's
  client_side/server_side per project, conservatively marks restricted
  only when one side is "unsupported", leaves ambiguous cases as "both"
- pack/pack.lock.json: bootstrap-populated sides (3 client, 5 server,
  rest both); CurseForge mods default to "both" pending manual review;
  version bumped 0.9.3 -> 0.10.0 since clients must re-sync

Compatibility:
- Old launcher + new manifest: ignores unknown "side", downloads all
- New launcher + old manifest: side null -> "both", installs all
- Old server + new manifest: same -- runtime Modrinth lookup still works
- New server + old manifest: side null -> runtime lookup, same behaviour

scripts/Build-Pack.ps1

@@ -77,14 +77,21 @@ $files = @()
 $totalBytes = 0L
 
 foreach ($mod in $lock.mods) {
-    $files += [pscustomobject]@{
+    # `side` is emitted only when explicitly set in the lockfile -- a missing or
+    # null lockfile side means "both", and we keep the manifest clean by omitting
+    # the field rather than serialising "both" everywhere.
+    $entry = [ordered]@{
         path = $mod.path
         url  = $mod.url
         sha1 = $mod.sha1
         size = $mod.size
     }
+    $hasSide = ($mod.PSObject.Properties.Name -contains 'side') -and $mod.side -and $mod.side -ne 'both'
+    if ($hasSide) { $entry.side = $mod.side }
+    $files += [pscustomobject]$entry
     $totalBytes += $mod.size
-    Write-Host ("  [{0}] {1,-26} {2,-22} {3,8:N0} KB" -f $mod.source.PadRight(7).Substring(0,7), $mod.slug, $mod.version, ($mod.size/1KB))
+    $sideTag = if ($hasSide) { "  [$($mod.side)]" } else { '' }
+    Write-Host ("  [{0}] {1,-26} {2,-22} {3,8:N0} KB{4}" -f $mod.source.PadRight(7).Substring(0,7), $mod.slug, $mod.version, ($mod.size/1KB), $sideTag)
 }
 
 # Local overrides (configs, custom files not on Modrinth/CurseForge)