Initial work for standalone manifest per sponsorable account

[kzu]

We'll move to a self-hosted model where each sponsorable account can opt-in to using SL by:

• Creating a GH OAuth app
• Forking this repository which provides the backend for manifest signing
• Leveraging the unified gh sponsors CLI to manage all manifests

This removes the need for cross-sponsorable sync, issues around local-only manifest generation (and therefore, hacking) and others.

This brings the model back to a simpler approach, yet extensible enough that others can leverage it with minimal (although not non-existent) effort.