Surface audit source on timeline entries

### Description

### Description

Timeline entries are built from audit log rows that already carry the `source` column (added in #7562), but the `timelineEntry()` formatter in `forge/db/views/AuditLog.js` strips it out. The frontend `TimelineEvent.vue` has no source display either.

This means actions performed via the API, MCP, or the Expert agent look identical to manual UI actions in the timeline view, even though the audit log correctly distinguishes them.

### Changes

**Backend (`forge/db/views/AuditLog.js`):**
- Add `source` (nullable string) to the `TimelineEntry` schema
- Include `source` in the `timelineEntry()` formatter output (it's already on the raw audit log row)

**Frontend (`frontend/src/components/version-history/timeline/TimelineEvent.vue`):**
- Show a source icon + tooltip next to the username, reusing the same pattern from `AuditEntry.vue` (SparklesIcon for mcp/mcp:expert, CommandLineIcon for api)

### Epic/Story

https://github.com/FlowFuse/flowfuse/issues/7425

### Have you provided an initial effort estimate for this issue?

I have provided an initial effort estimate

Start with forge/db/views/AuditLog.js and inspect the TimelineEntry schema and timelineEntry() formatter, then compare the source display pattern in frontend/src/components/version-history/AuditEntry.vue. Update frontend/src/components/version-history/timeline/TimelineEvent.vue to show the appropriate source icon and tooltip beside the username. Done means timeline entries preserve nullable source values and distinguish MCP, Expert agent, API, and manual actions where applicable.

Written by the indexing model from the issue text.