fix(database): prevent item source reassignment

[wizardengineer]

Summary

• reject changes to an existing item's source UUID at the database boundary
• preserve one-time initialization when the stored source is null or missing
• cover reassignment rejection and preservation of decrypted local state

Context

Refs #3564.

This follows the database-level immutability pattern used for item kind in #3173.

Test plan

cd app
pnpm exec vitest run --config vitest.config.ts --project=unit \
  src/main/datastore.test.ts --poolOptions.forks.singleFork

Observed: 68 tests passed.

cd app
pnpm test

Observed: 889 tests passed across 52 files.

cd app
tmp_home=$(mktemp -d)
HOME="$tmp_home" pnpm run dbmate:check

Observed: all migrations applied and the generated schema matched.

cd app
pnpm lint
git diff --check origin/main...HEAD

Observed: formatting, ESLint, both TypeScript checks, and the diff check passed.

Checklist

This change accounts for:

• testing changes on Qubes as needed (especially changes related to cryptography, export, disposable VM use, or complex UI changes)
• any needed updates to the AppArmor profile for files beyond the application code
• any needed self-contained database migrations (including testing against a clean test database from main)