refactor(store): reduce Sonar complexity

[aksOps]

Summary

• decompose store search, settings, secret publication, forge source, markdown import, and board transaction paths into package-local helpers
• preserve SQL scope/order, credential-origin clearing, secret durability, receipt/CAS precedence, canonical identity, timestamps, labels, and tombstones
• add regression coverage for publication order, rollback, equal-title identity, and strict empty-patch behavior
• leave patchTask production code unchanged for a separate evidence-backed ACCEPTED disposition

Expected Sonar delta

Closes nine Go production complexity findings:

• AZ-8DLJxETN2Y3sJmEuI
• AZ-8DLJZETN2Y3sJmEt8
• AZ-8DLJZETN2Y3sJmEt9
• AZ-8DLKWETN2Y3sJmEuR
• AZ-8DLKOETN2Y3sJmEuQ
• AZ-8DLJnETN2Y3sJmEuB
• AZ-8DLJnETN2Y3sJmEuC
• AZ-8DLJnETN2Y3sJmEuD
• AZ-8DLJnETN2Y3sJmEuE

Verification

• 905/905 frontend tests; coverage lines 99.43%, branches 95.21%
• frontend build passed
• all Go packages passed
• all Go packages passed uncached under the race detector
• Go vet, staticcheck, repository formatting, and diff checks passed
• all 14 commits have valid ED25519 signatures
• independent integrated review approved with no findings
• final PR Sonar scan: quality gate passed, 0 new issues, 97.2% new-code coverage, 0.0% duplication

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
97.2% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud