chore: remove duplicate copies of the site, download center and installers (WS-C)

The landing page, download pages, invite page, assetlinks and installers
existed in two or three places; only site/ and the Forgejo feed are served.

- apps/api-server/wwwroot: delete the stale site build, download/invite
  pages, .well-known copy, legacy static admin and 1.0.0 binaries. The API
  no longer serves static files (UseStaticFiles/fallbacks and the apk/zip
  blocker removed); the Next admin is the only admin UI.
- Delete 19 tracked installers/packages (~568 MiB) under site/public/releases,
  apps/web/public/releases and wwwroot/releases; .gitignore blocks them.
- apps/web: delete the download/releases pages, desktop-release.ts, the
  download.html and assetlinks copies, and the accept-invite page (invites
  are only issued to the site's /accept-invite/). e2e specs call the /app
  base path and check the /download redirect instead.
- scripts: delete the retired release/NAS site scripts, drop the web target
  from sync-version, and check assetlinks in site/public only.
- Delete the unused Dockerfile.admin (apps/admin/Dockerfile is used).

Policy: docs/REFACTOR_POLICY.md Wave 3, W3-5 and W3-6.

.gitignore

@@ -118,9 +118,13 @@ apps/mobile-rn/android/app/src/main/res/drawable-*/node_modules_*
 /supabase/.branches/
 /supabase/.temp/
 
-# Release binaries are not committed: the canonical distribution channel is the
-# Forgejo update feed, and none of these trees are part of a build graph.
-# Historical 1.0.0 copies stay tracked until they are retired.
-/site/public/releases/*/
-/apps/web/public/releases/*/
-/apps/api-server/wwwroot/releases/*/
+# Release binaries are never committed: the only distribution channel is the
+# Forgejo update feed (release/update-policy.json). Landing/download/legal/invite
+# pages live only in site/, so the API server has no wwwroot at all.
+/site/public/releases/
+/apps/web/public/releases/
+/apps/api-server/wwwroot/
+*.apk
+*.aab
+*.blockmap
+D3RO-Voice-Setup-*.exe