fix(helm): persist and recover chart sources

[StefanSa]

Problem

Helm release storage retains chart metadata but not reliable original chart-source provenance. After restart, moving Radar between machines, or for older releases, Radar can therefore lose the repository/OCI source required to reconstruct the exact installed chart.

This is especially important for safe Values Preview/Apply because complete chart reconstruction must not depend on machine-local repository aliases.

Fix

• Persist per-release chart-source provenance.
• For classic Helm repositories, retain both repository name and canonical URL.
• For OCI, retain the exact chart source without storing credentials.
• Recover existing releases from configured sources when unambiguous.
• Never guess between multiple matching sources.
• Support cross-machine recovery.
• Keep manual Helm repository and OCI recovery available.
• Add explicit opt-in ArtifactHub-assisted discovery for legacy unresolved releases.
• Treat ArtifactHub only as discovery metadata; independently verify the exact chart name/version/package/source before association.
• Improve Track Chart Source form clarity and recovery UX.
• Preserve fail-closed complete-chart reconstruction.

Safety

• No credentials are persisted in release provenance.
• ArtifactHub lookup is explicit/opt-in and sends only the chart name.
• Ambiguous or unverifiable sources remain unresolved.
• Exact installed versions are required.
• Incomplete dependency trees remain fail-closed.

Tests

• go test ./internal/helm -count=1
• Classic repository and OCI provenance/recovery, including cross-machine recovery and ambiguity handling.
• ArtifactHub HTTP/OCI discovery, privacy, independent exact-version verification, and dependency validation.
• Focused frontend source-recovery tests and frontend typecheck.
• Real existing-release Preview/recovery validation without unintended Helm revision changes.

Dependency

Depends on #1631, which provides the fail-closed complete-chart reconstruction used by this recovery path.