feat(updater): back up the local database before an update; guard against a newer schema; Release channel row on managed installs #1497

Part of the Beta channel epic #1499.

Problem

The beta line can carry a newer local database schema than the stable release it is promoted to (or that the user falls back to by installing an older build by hand). Today the only protection is the recovery screen when LocalDb cannot be opened (#1375). Nothing backs the database up before an in-app update, and nothing tells a user that a downgrade is unsafe.

Separately, Preferences shows Release channel to everyone, but on a package install (AUR, .deb, .rpm, Snap, Flatpak) the channel has no effect: the update is made by the package manager (#1491). This is confusing.

Scope

• Backup before an in-app update: before installDownloadedUpdate quits the app, copy the local database file (and the QueryaData metadata) next to it as querya.db.pre-<from>-<to>.bak (keep the last 3); report a failure and let the user continue or cancel.
• Schema version guard: store the schema version in the database; on open, if it is newer than the app knows, do not migrate or write: show the recovery screen with a specific message (This data was written by a newer Querya (0.5.0-beta.2). Update, or restore <backup>).
• Release channel row: on managed installs show the row disabled with the text Updates come from your package manager.
• Document the downgrade rule in docs/security.md / user guide.

Acceptance

• An update leaves a .bak file, an old one is pruned.
• Opening a database with a schema version newer than the app's never modifies it.
• The Release channel row is disabled with an explanation on AUR / deb / rpm / Snap / Flatpak installs.
• Tests for the backup rotation and the newer-schema guard.