fix: allow sponsor Java source without local key

[xiwangly2]

Summary

This follow-up fixes a usability regression after #112: the Java sponsor/high-speed source should still be installable without a locally saved sponsor key when the artifact exists.

This matches the upstream sponsor-download comments from server/src/utils/sponsorDownload.ts: missing/invalid sponsor key or unavailable session service should fall back to the ordinary download channel, not disable the source.

Changes:

• Allow sponsor/high-speed Java catalog options without requiring a local sponsor key.
• Keep sponsor/high-speed source first on supported platforms; on unsupported platforms such as riscv64 without a sponsor artifact, the first option falls through to Temurin/system packages.
• Treat the local sponsor key as an optional session-cookie enhancement for the same direct link.
• Update Environment page copy and Java sponsor-download docs to avoid implying the source requires sponsorship to be usable.
• Add catalog tests for no-key sponsor availability and riscv64 fallback ordering.

Validation

• git diff --check upstream/main...HEAD
• npm test --prefix server -- --runTestsByPath src/__tests__/java-download-artifacts.test.ts src/__tests__/architecture-support.test.ts -> 2 suites / 16 tests passed
• npm run build --prefix server
• npm run build --prefix client -> passed, with existing Vite dynamic-import/chunk-size warnings only