fix(fetch): guard item status transitions

[wizardengineer]

Summary

• make worker fetch-status writes conditional on an allowlisted current state
• restrict renderer requests to explicit download, pause, and cancel transitions
• keep the SQL transition guard compatible with the app Semgrep policy

Context

Refs #3567.

This extends the deletion guards added in #3440 to every later status write.

Test plan

cd app
pnpm exec prettier src/main/database/index.ts --check
pnpm exec eslint --max-warnings 0 src/main/database/index.ts
pnpm run typecheck:node

Observed: Prettier reported the file uses project style, ESLint exited 0, and
typecheck:node exited 0.

uvx semgrep scan --metrics=off --error --strict --config app/.semgrep app/src/main/database/index.ts
git diff --check

Observed: the custom app Semgrep rules scanned database/index.ts with 0
findings, and the diff check passed.

cd app
pnpm exec vitest run --config vitest.config.ts --project=unit \
  src/main/datastore.test.ts src/main/database/search.test.ts \
  src/main/fetch/queue.test.ts src/main/index.test.ts \
  src/main/fetch/fetch-status-transitions.test.ts

Not completed locally: this macOS environment is running Node v26.0.0, and
pnpm install failed during postinstall while trying to download the
better-sqlite3 node-v147 darwin-arm64 artifact, which returned 404. The
database-backed test command therefore failed before assertions at the missing
native binding load.

make lint
cd app && pnpm lint
cd app && pnpm test
cd app && pnpm build:linux

Not run locally: make lint requires Poetry, which is not installed here; the
full app lint/test/build commands are left for CI because local dependency
postinstall could not complete under Node v26.

Notes

The CI fix removes the dynamic SQL predicate interpolation that tripped
app..semgrep.better-sqlite3-ban-dynamic-content; the same allowed enum values
are now spelled directly in the prepared statements. Qubes and packaged Linux
builds were not run locally.

Checklist

This change accounts for:

• testing changes on Qubes as needed (especially changes related to cryptography, export, disposable VM use, or complex UI changes)
• any needed updates to the AppArmor profile for files beyond the application code
• any needed self-contained database migrations (including testing against a clean test database from main)