tag v3.8.0: API features

Mutations and queries that existed in sr.ht's API but that Hutch never called.

Artifacts can be uploaded to and deleted from release tags, and download works
for the first time — Artifact.url points at the API origin and 401s without a
bearer token, so handing it to Safari could never have worked. The meta.sr.ht
audit log is readable in Profile. Mailing lists can be created, configured, and
deleted.

Three of the six planned. archiveMessage is @internal. Webhook management,
shareSecret, and build groups are reachable but declined — see SCOPE.md. The
ticket activity feed was built and then removed: todo.sr.ht's root events
resolver joins event.participant_id against participant.user_id, which are
different id spaces, so it returns an empty list for every user.

Manual testing found seven bugs a clean build and 241 tests all passed, four of
them pre-existing: a download that never worked, deleted repositories lingering
because deletion never invalidated the cache while forceRefresh only reached
build statuses, destructive swipes animating rows out before their
confirmations, and a mailing list opened from a project blanking the screen.