feat(brain): stamp server-owned write provenance; surface it in brain_query

brain_write was an ungated, durable prompt-injection path: a session that
just read an untrusted page could write an entry every later session
retrieves as trusted guidance (OWASP MCP06). Decision (#145): tag
provenance rather than stage writes.

Every write and update stamps origin (static | jwt | unknown) and
written_by (the authenticated principal) into frontmatter. Server-owned:
origin/written_by in caller content or an update fragment are discarded,
so a caller cannot claim a more trusted origin. No principal stamps
origin: unknown, never silence. brain_update re-stamps to the last
writer. capture (the claude.ai connector door) stamps too, via a new
server-derived CaptureContext.AuthPath set by both capture doors after
decode. REST POST /write carries no principal and stamps unknown.

brain_query results carry origin/written_by when the note has them;
older notes omit them rather than fabricate. brain_get already returns
frontmatter.

Refs #145

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/internal/brainstore/store.go

@@ -49,10 +49,12 @@ func (s *Store) Write(ctx context.Context, n capture.Note) (capture.Ref, error)
 	n.Content = content
 
 	relPath, err := api.WriteNote(s.brainDir, api.WriteNoteOptions{
-		Content:  n.Content,
-		Filename: n.Filename,
-		Wing:     n.Wing,
-		Hall:     n.Hall,
+		Content:   n.Content,
+		Filename:  n.Filename,
+		Wing:      n.Wing,
+		Hall:      n.Hall,
+		Origin:    n.Origin,
+		WrittenBy: n.WrittenBy,
 	})
 	if err != nil {
 		return capture.Ref{}, err
@@ -74,7 +76,7 @@ func (s *Store) Update(ctx context.Context, slug string, n capture.Note) (captur
 	}
 	n.Content = content
 
-	opts := api.UpdateNoteOptions{Content: n.Content, Reason: n.Reason}
+	opts := api.UpdateNoteOptions{Content: n.Content, Reason: n.Reason, Origin: n.Origin, WrittenBy: n.WrittenBy}
 	if strings.Contains(slug, "/") {
 		opts.Path = slug
 	} else {