fix(api): default hall=facts source_type to internal (brain-gardener#7)

The unsourced-check fix (source_type: internal) only covered
claudewatcher's writes. 41 residual findings on the audit's next run
were manually-authored hall=facts entries written via brain_write/
capture -- also first-party observations, just a different write path,
with no way to mark them internal short of hand-editing every entry.

writeHallNote now defaults source_type to internal whenever hall ==
"facts" and the caller didn't set it explicitly. An explicit
source_type: external (now threaded through the /write HTTP endpoint)
opts a genuinely citation-needing entry back out.

ingestion/internal/api/handler.go

@@ -51,12 +51,13 @@ type queryRequest struct {
 }
 
 type writeRequest struct {
-	Content  string `json:"content"`
-	Filename string `json:"filename,omitempty"`
-	Type     string `json:"type,omitempty"`
-	Domain   string `json:"domain,omitempty"`
-	Wing     string `json:"wing,omitempty"`
-	Hall     string `json:"hall,omitempty"`
+	Content    string `json:"content"`
+	Filename   string `json:"filename,omitempty"`
+	Type       string `json:"type,omitempty"`
+	Domain     string `json:"domain,omitempty"`
+	Wing       string `json:"wing,omitempty"`
+	Hall       string `json:"hall,omitempty"`
+	SourceType string `json:"source_type,omitempty"` // "external" opts a hall=facts entry out of the internal default
 }
 
 type ingestRequest struct {
@@ -166,8 +167,16 @@ func writeHallNote(brainDir string, opts WriteNoteOptions) (string, error) {
 	if opts.Domain != "" {
 		fmt.Fprintf(&fm, "domain: %s\n", opts.Domain)
 	}
-	if opts.SourceType != "" {
-		fmt.Fprintf(&fm, "source_type: %s\n", opts.SourceType)
+	sourceType := opts.SourceType
+	if sourceType == "" && opts.Hall == "facts" {
+		// Most hall=facts entries are first-party (an eval/benchmark the
+		// writer ran itself), not external claims — default to internal and
+		// require an explicit source_type: external opt-out for the rare
+		// citation-needing entry (brain-gardener#7).
+		sourceType = "internal"
+	}
+	if sourceType != "" {
+		fmt.Fprintf(&fm, "source_type: %s\n", sourceType)
 	}
 	fm.WriteString("---\n")
 
@@ -232,12 +241,13 @@ func (h *Handler) Write(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	relPath, err := WriteNote(h.brainDir, WriteNoteOptions{
-		Content:  req.Content,
-		Filename: req.Filename,
-		Type:     req.Type,
-		Domain:   req.Domain,
-		Wing:     req.Wing,
-		Hall:     req.Hall,
+		Content:    req.Content,
+		Filename:   req.Filename,
+		Type:       req.Type,
+		Domain:     req.Domain,
+		Wing:       req.Wing,
+		Hall:       req.Hall,
+		SourceType: req.SourceType,
 	})
 	if err != nil {
 		h.logger.Error("write failed", "err", err)