fix: respect system rotation lock in PWA

[qingchunnh]

Summary

问题：Android PWA 在系统未开启自动旋转时，仍会跟随设备旋转为横屏。

根因：后端动态生成的 Web App Manifest 中硬编码了 "orientation": "any"。
Android 上安装的 PWA 会被打包为 WebAPK，manifest 中显式声明的 orientation
（包括 "any"）会被映射为传感器驱动的 android:screenOrientation，
从而忽略系统的自动旋转开关。只有不声明该字段时，WebAPK 才会遵循系统旋转锁定。

方案：从 manifest 响应中移除 orientation 字段（handler + DTO），
并同步更新生成物（Swagger 文档与 api-contract 类型）。移除后 manifest
不再包含 orientation 键，WebAPK 走系统默认行为：系统锁定旋转时保持竖屏，
开启自动旋转时自由旋转。

Fixes #516

Change type

• Bug fix
• Feature
• Documentation
• Refactor
• Configuration / deployment
• Security hardening
• Other

Affected areas

• Frontend / UI
• Backend / API
• Authentication / authorization
• Conversations / streaming
• Files / RAG / extraction
• Model routing / providers
• MCP / tools
• Billing / payments
• Admin console
• Deployment / Docker / configuration
• Documentation

Verification

通过 GitHub Actions 验证并已在 Android 手机上手动验证

Screenshots, API examples, or logs

Configuration, migration, and compatibility notes

• 需重新部署后端后生效。
• 已安装的 WebAPK 不会立即更新：Chrome 需检测到 manifest 变化后重新生成 WebAPK，老用户可能需等待自动更新或重装 PWA。
• API 契约变更：BrandingManifestResponse 移除 orientation 字段， 已同步 backend/docs/（Swagger）与 packages/api-contract/src/types.generated.ts。前端无代码引用该字段。

Documentation

• Documentation is not needed for this change.
• Documentation was updated.
• Documentation still needs to be updated.

Security and privacy

• No secrets, tokens, credentials, local config, or personal data are included.
• User data access remains scoped by authenticated user context unless an admin-only path explicitly requires broader access.
• Security-sensitive behavior was reviewed, including authentication, authorization, provider routing, file processing, billing, and admin APIs where relevant.

Checklist

• I searched existing issues and pull requests.
• Changes are focused and do not include unrelated refactors.
• Tests or static verification were run where practical.
• User-facing behavior, deployment steps, API contracts, or configuration changes are documented.
• Generated artifacts are included only when this project explicitly requires them.
• Caches, build output, .pyc files, .env files, and local storage data are not committed.