fix(fetch): block pending-deleted item processing

[wizardengineer]

Summary

• Marks raw item rows as ScheduledDeletion when an item_deleted pending event is created.
• Excludes pending-deleted items from raw fetch intake and worker processability checks, including legacy/direct pending-event rows.
• Makes worker DB writes conditional so a deletion that wins the race before completion cannot persist plaintext, filenames, retry states, or search index entries.

Context

Refs #3575.

The projected conversation view already hides items with pending item_deleted events, but the fetch/decrypt worker reads raw items rows. This patch binds the pending deletion to raw processability and to the final DB completion write, so a hidden deleted item cannot continue through download/decrypt and store plaintext after the UI action.

Test plan

cd app
pnpm run lint

Observed result:

All matched files use Prettier code style!
tsc --noEmit -p tsconfig.node.json --composite false
tsc --noEmit -p tsconfig.web.json --composite false

cd app
TMP_HOME=$(mktemp -d /tmp/sdc-3575-dbmate-home.XXXXXX)
mkdir -p "$TMP_HOME/.config/SecureDrop"
HOME="$TMP_HOME" pnpm run dbmate:check

Observed result:

Applying: 20260710000000_pending_item_deletion_scheduled_deletion.sql
Writing: ./src/main/database/schema.sql
Writing: ./src/main/database/schema.sql

cd app
pnpm exec vitest run --config vitest.config.ts --project=unit \
  src/main/database/search.test.ts \
  src/main/datastore.test.ts \
  src/main/fetch/queue.test.ts \
  src/main/index.test.ts

Observed result:

Test Files  4 passed (4)
Tests  193 passed (193)

cd app
pnpm test

Observed result:

Test Files  52 passed (52)
Tests  895 passed (895)

cd app
pnpm run build:linux

Observed result:

✓ built in 3.33s
• building target=snap arch=x64 file=dist/securedrop-app_1.5.0-rc1_amd64.snap
• building target=AppImage arch=x64 file=dist/securedrop-app-1.5.0-rc1.AppImage

git diff --check HEAD

Observed result: no output.

Notes

I ran the app checks locally with Node 24.16.0 to match the app workflow's Node 24 setup.

I did not run pnpm server-test locally because the shared SecureDrop server-test slot was reserved for another acceptance run. The added regression coverage exercises the production database and worker completion paths without starting the server harness.

Checklist

This change accounts for:

• testing changes on Qubes as needed (especially changes related to cryptography, export, disposable VM use, or complex UI changes)
• any needed updates to the AppArmor profile for files beyond the application code
• any needed self-contained database migrations (including testing against a clean test database from main)