feat(podcasts): edit segregation — feed metadata is fetcher-owned (task 1.8)

D9/D10: users never edit podcast episode metadata. Three gates:

- Generic edit endpoint (UpdateMediaItem) rejects source=
  'podcast_episode' items with 400 — the next fetch refresh would
  clobber any edit anyway, and the fetcher is the sole metadata writer.
- Write-to-file (MetadataWriter.WriteMetadataToFile) refuses podcast
  episodes for the same reason (tag write-back for downloaded episodes
  is a named Phase-4 item needing its own iTunes-tag mapping).
- The book-detail page hides the admin Edit affordance for
  podcasts-type items (direct-URL visits), and the metadata-editor
  modal's field list has no podcast fields by construction (fixed
  templ field list) — episodes render read-only via /podcasts
  surfaces.

internal/handlers/media.go

@@ -1542,6 +1542,13 @@ func (mh *MediaHandler) UpdateMediaItem(c *echo.Context) error {
 		return c.JSON(http.StatusNotFound, map[string]string{"error": "media item not found"})
 	}
 
+	// Edit segregation (plan D10, task 1.8): podcast episodes are
+	// fetcher-owned (D9 — the sole writer); the generic edit box would
+	// clobber feed metadata that the next refresh overwrites anyway.
+	if existing.Source == "podcast_episode" {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "podcast episodes are managed by their feed and cannot be edited here"})
+	}
+
 	coverPath := existing.CoverImagePath.String
 	coverUploaded := false