feat(podcasts): edit segregation — feed metadata is fetcher-owned (task 1.8)

D9/D10: users never edit podcast episode metadata. Three gates:

- Generic edit endpoint (UpdateMediaItem) rejects source=
  'podcast_episode' items with 400 — the next fetch refresh would
  clobber any edit anyway, and the fetcher is the sole metadata writer.
- Write-to-file (MetadataWriter.WriteMetadataToFile) refuses podcast
  episodes for the same reason (tag write-back for downloaded episodes
  is a named Phase-4 item needing its own iTunes-tag mapping).
- The book-detail page hides the admin Edit affordance for
  podcasts-type items (direct-URL visits), and the metadata-editor
  modal's field list has no podcast fields by construction (fixed
  templ field list) — episodes render read-only via /podcasts
  surfaces.

internal/services/metadata_writer.go

@@ -110,6 +110,14 @@ func (w *MetadataWriter) WriteMetadataToFile(ctx context.Context, itemID uuid.UU
 		return nil, fmt.Errorf("media item not found: %w", err)
 	}
 
+	// Edit segregation (plan D10/D9, task 1.8): podcast episodes are
+	// feed-managed; writing their metadata into the file would be
+	// clobbered by the next download/refresh and violates the
+	// fetcher's sole-writer rule.
+	if item.Source == "podcast_episode" {
+		return nil, fmt.Errorf("podcast episodes are managed by their feed; metadata write-to-file is not available")
+	}
+
 	absPath, err := w.libraries.ResolveMediaPath(ctx, item.LibraryID, item.FilePath)
 	if err != nil {
 		return nil, fmt.Errorf("cannot resolve library folder: %w", err)