WP-O2b: origin derivation (no live tag touched)

Part of the origin-dimension implementation plan: adobe/serenity-docs#46 (branch `feat/origin_source`).

Touches no tag tree, no live data. May share WP-O2a's PR or follow it.

- `handlers/prompts.js:384`: generalize `makeTypeInjector` to strip+inject `type` and `origin`, with create/update asymmetry — create injects derived value, update re-injects the *stored* origin and never re-derives. Strip by resolved tag id beneath the root, never by name.
- `prompts-storage.js:792` `upsertPrompts`: write the origin derived from the request's **principal** — service principal: asserted body value, validated; user principal: always `human`, body ignored.
- `prompts-storage.js:1006-1007` `updatePromptById`: stop patching `origin` from the body.
- `prompts-storage.js:408` `mapRowToPrompt`: return `row.origin` directly, drop the `|| 'human'` fallback (zero NULLs in prod, spec §2.3 — the fallback would now silently mislabel).
- `src/controllers/brands.js`: `createPromptsByBrand` derives origin from principal. Origin query filter/sort key stay.
- `docs/openapi/schemas.yaml` / `prompts-v2-api.yaml`: `origin` stays on `V2PromptInput`/`V2Prompt`, re-documented as service-principal-only; PATCH body no longer honours it.
- **No change needed in llmo-data-retrieval-service** — its `V2Prompt` model pins `origin: Literal["ai"]` and POSTs as a service principal; that stays correct.

Exit: unit + it-postgres integration green. Spec gates 5,6,7,8 land here.

Blocked on the tag-vs-metadata product decision.

Jira: SITES-48002

Start with handlers/prompts.js:384, prompts-storage.js at 408, 792, and 1006-1007, and src/controllers/brands.js to trace origin derivation and update behavior. Review the OpenAPI schema files for the documented principal rules, then run the unit and it-postgres integration suites. Done means those suites are green and spec gates 5, 6, 7, and 8 land after the tag-vs-metadata decision is resolved.

Written by the indexing model from the issue text.