Add explicit client/server side field to manifest

Bake each file's "side" (client / server / both) into manifest.json at
build time so both the launcher and the server filter deterministically
and offline. This replaces the launcher's previous "download everything"
default and lets the server short-circuit its runtime Modrinth lookup
when a file already has an authoritative tag.

Schema:
- ManifestFile.Side: "client" | "server" | "both" (null = "both" for
  backward compat with manifests pre-dating this field)
- Files marked "both" omit the field entirely to keep the JSON tight

Code changes:
- launcher Manifest.cs + ManifestSyncService: filter out "server" files
  in both the prune+download path and FindMissingFiles
- server Manifest.cs + ManifestSync: drop "client" files outright; only
  fall back to the existing runtime Modrinth lookup for files with no
  explicit side (legacy/un-tagged mods stay protected)
- server LockedMod: side field propagates into manifest at build time
- scripts/Build-Pack.ps1: propagate side from lockfile to manifest
- scripts/Bootstrap-Sides.ps1: one-off populator; queries Modrinth's
  client_side/server_side per project, conservatively marks restricted
  only when one side is "unsupported", leaves ambiguous cases as "both"
- pack/pack.lock.json: bootstrap-populated sides (3 client, 5 server,
  rest both); CurseForge mods default to "both" pending manual review;
  version bumped 0.9.3 -> 0.10.0 since clients must re-sync

Compatibility:
- Old launcher + new manifest: ignores unknown "side", downloads all
- New launcher + old manifest: side null -> "both", installs all
- Old server + new manifest: same -- runtime Modrinth lookup still works
- New server + old manifest: side null -> runtime lookup, same behaviour

server/Models/Manifest.cs

@@ -37,6 +37,12 @@ public sealed class ManifestFile
     [JsonPropertyName("url")]  public string  Url  { get; set; } = "";
     [JsonPropertyName("sha1")] public string? Sha1 { get; set; }
     [JsonPropertyName("size")] public long?   Size { get; set; }
+
+    /// <summary>
+    /// "both" (default), "client", or "server". Server skips "client" files;
+    /// launcher skips "server" files. Null/missing = "both".
+    /// </summary>
+    [JsonPropertyName("side")] public string? Side { get; set; }
 }
 
 public sealed class PackLock
@@ -59,4 +65,5 @@ public sealed class LockedMod
     [JsonPropertyName("url")]       public string  Url       { get; set; } = "";
     [JsonPropertyName("sha1")]      public string  Sha1      { get; set; } = "";
     [JsonPropertyName("size")]      public long    Size      { get; set; }
+    [JsonPropertyName("side")]      public string? Side      { get; set; }
 }