Category allowlist and changelog path flags added

Minor Changes

• 49873f1: Add --category-allow <list> and --no-category-allow flags to releases admin source update for setting per-source metadata.categoryAllow directly. Drops feed items whose <category> doesn't intersect the allowlist (case-insensitive); items with no category are dropped too. Useful on mixed-topic feeds where the upstream tags every entry — openai.com/news/rss.xml is the motivating case. Worker-side filter ships in buildinternet/releases#821.

  Also adds scripts/bulk-suppress.ts, an operator utility that reads {id, reason} NDJSON on stdin and runs releases.suppress with bounded concurrency (default 8). Used to clean up the existing noise on a source after enabling categoryAllow.

• 2cb93bb: Add --changelog-paths and --no-changelog-paths flags to releases admin source update for setting per-source metadata.changelogPaths overrides directly. Replaces the previous workflow of dropping to a raw curl against /v1/sources/.../metadata. Caps at 20 paths client-side to match the API worker's CHANGELOG_MAX_FILES.