fix(database): enforce source key immutability after TOFU initial write

[wizardengineer]

Summary

• add a SQLite trigger that rejects later changes to sources.data.public_key
  or sources.data.fingerprint
• add the dbmate migration and regenerated schema snapshot
• add datastore tests for the initial TOFU write, unchanged-key metadata updates,
  direct replacement rejection, and the updateSources() upsert path

Context

Refs #2955.

This follows the same database-level TOFU pattern used for immutable
items.data.kind in #3173.

Test plan

pnpm install --frozen-lockfile

tmp_home=$(mktemp -d /tmp/sd-dbmate-home.XXXXXX)
mkdir -p "$tmp_home/.config/SecureDrop"
HOME="$tmp_home" pnpm run dbmate up
HOME="$tmp_home" pnpm run dbmate dump

pnpm exec vitest run --config vitest.config.ts --project=unit src/main/datastore.test.ts
pnpm exec prettier src/main/datastore.test.ts --check
git diff --check

Notes

This draft focuses on the database-level source key immutability check. It still
uses TOFU semantics, so the first synchronized source key is trusted. It also
does not yet add a cryptographic check that fingerprint matches public_key;
I kept that separate because it likely belongs in the sync/OpenPGP parsing path
rather than inside a self-contained SQLite migration.

Checklist

This change accounts for:

• testing changes on Qubes as needed (especially changes related to
  cryptography, export, disposable VM use, or complex UI changes)
• any needed updates to the AppArmor profile for files beyond the
  application code
• any needed self-contained database migrations (including testing against
  a clean test database from main)