fix: make npm run release work from the frontend subdir

[DeaglePC]

Problem

npm run release (added in #5) didn't actually cut a release. When npm version runs from frontend/ — which is a subdirectory of the git repo, not the git root — it decides it is "not a git repository" and silently skips creating the release commit and tag, while still running the version/postversion lifecycle scripts. The net effect:

• version files got bumped but left uncommitted,
• postversion's git push fired prematurely (pushing the wrong commit),
• no vX.Y.Z tag was created, so CI never built a Release.

Fix

Drive git explicitly from a script instead of relying on npm version's built-in git step.

• Add scripts/release.mjs:
  1. Require a clean working tree (fails loudly instead of half-releasing).
  2. Bump package.json + package-lock.json via npm version <type> --no-git-tag-version.
  3. Sync manifest.json.
  4. Warn if changelog.json has no entry for the new version.
  5. git commit → annotated git tag → git push --follow-tags.
• Repoint release[:patch|minor|major] at the script; drop the version and postversion lifecycle hooks.
• Remove the now-unused sync-manifest-version.mjs.

Result

npm run release now reliably commits the bump, tags vX.Y.Z, and pushes — triggering CI to build the zip and create the GitHub Release. Verified the clean-tree guard aborts safely on a dirty tree.

Note: the v1.0.2 release commit + tag are landing on main separately (out of band) using the old manual recovery; this PR only contains the flow fix and does not touch the version number.

🤖 Generated with Claude Code