fix(api): honor the request's origin as the writer label — app rows stop wearing "web"

Every web-API write endpoint hardcoded Source:"web", so the Android
app's own pushes landed with last_sync_source/last_modified_source
"web" — the app was indistinguishable from the web SPA in progress
conflicts, device_sync_data, and annotation bookkeeping. The app CAN
say who it is (bookmark create already carried origin → origin_source);
the server just ignored it for labeling.

All six write sites (progress PUT, bookmark/note/highlight create+PUT)
now parse an ADDITIVE optional "origin" key, normalized through one
gate: "android"/"ios" pass through, anything absent/unknown stays
"web" (the label keys conflict claims and device_sync_data — free-form
client strings would pollute them). Precedence on progress: a paired
X-Device-Token still outranks origin. Bookmark origin_source now rides
the same gate. The web SPA sends no origin — its rows are unchanged;
KOReader/Kobo handlers keep their own labels.

Wire discipline: additive request keys only (rule 2), response shapes
untouched, pins changelog widened in-commit, locked by
TestOriginWriterAttribution (android lands, default stays web, unknown
normalizes). Full battery: only the two known pre-existing failures
(TestOPDSLibraryFolders rot, TestWebSocketPingPong — both reproduce
with the change stashed).

internal/sync/progress.go

@@ -319,6 +319,10 @@ type SaveProgressRequest struct {
 	ScrollY         *float64 `json:"scroll_position_y"`
 	PanelNumber     *int     `json:"panel_number"`
 	ReadingMode     *string  `json:"reading_mode"`
+	// Optional client label ("android"/"ios") — the web handler normalizes
+	// it into Source (writer attribution) unless a paired device token
+	// claimed the push. Absent/unknown stays "web".
+	Origin string `json:"origin"`
 	// Audiobook locator (seconds into the current chapter)
 	AudioOffsetSeconds *int `json:"audio_offset_seconds"`