fix: preserve original GTFS source in reports

[mackenziereading19]

Summary

Fixes #1539 by preserving the human-readable GTFS source separately from the operational source used by the validator.

For web uploads, reports now show the original uploaded filename instead of the temporary server-side filename. For URL submissions, reports show the original URL, as requested in the issue discussion.

Implementation

• Add optional originalGtfsSource provenance to ValidationRunnerConfig while retaining gtfsSource for operational file/URL access.
• Add a single display-source fallback (originalGtfsSource when present, otherwise gtfsSource) used by JSON and HTML reports.
• Forward uploaded filenames from the web client through CreateJobRequest and persisted JobMetadata.
• Persist URL provenance even when no country code is supplied.
• Forward persisted provenance through ValidationController and ValidationHandler without changing the operational temporary file URI.
• Preserve compatibility with existing callers and previously persisted JobMetadata that does not contain originalGtfsSource.

Validation

• Full :main:test passed.
• Full :web:service:test passed.
• :main:spotlessCheck passed.
• :web:service:spotlessCheck passed.
• npm run check passed with 0 errors and 0 warnings (3 pre-existing hints).
• Full Cypress suite passed: 7/7 tests.
• Regression coverage verifies uploaded filename propagation to /create-job.
• Regression coverage verifies URL and filename provenance persistence.
• Regression coverage verifies operational gtfsSource remains separate from originalGtfsSource.
• Regression coverage verifies JSON and HTML report source selection.
• Backward-compatibility test verifies old two-field JobMetadata JSON still deserializes with originalGtfsSource == null.
• git diff --check passed.

Closes #1539