feat([issue-5638]): stamp model and LoRA licenses onto generated assets

[atomanticagent]

Summary

• Stamp model + LoRA license/sourceUrl onto image sidecars and video-history rows at finalize (local and federated). Unknown stays null (shown as "unknown") — never a permissive default, never disclosure.runtimeLicense, never Civitai allowCommercialUse.
• Persist license on LoRA install sidecars so the stamp can be written from what was known at render time, not a later re-read.
• Roll up distinct sources into an Attribution & licenses section on the media lightbox, collection pages, and pipeline export.

Closes #5638

Test plan

• server: assetProvenance, civitai sidecar, huggingface LoRA sidecar, imageGen local.buildSidecarMeta, image/video remote, lib barrel
• client: AttributionList, MediaLightbox, lib barrel
• CI Gate / Server tests / Client tests green