feat(sync): Phase 1 - separate sync pull from user operations
- Add mergeServerItem() to datastore.ts that preserves server metadata
- Update sync.ts to use direct DB operations instead of addItem/updateItem
- Server _sync metadata now preserved during sync pull without device metadata
- Removes dependency on syncSource parameter for metadata guard
- Keeps syncSource column for backward compatibility (Phase 3 removal)
This implements the mobile pattern where sync pull is architecturally
separate from user-facing save/update commands, preventing accidental
overwrite of server device metadata (_sync.createdBy, _sync.modifiedBy).