Backfill datasourceId catalog links on chat dataSources[] entries (admin)

Legacy chats carry dataSources[] entries without a datasourceId FK to the built-in datasource catalog, so the security guard skips catalog enhancement (e.g. WEB_SEARCH provider inheritance). This migration backfills the FK for singleton built-in types (LLM_KNOWLEDGE, WORKSPACE, SHARED, PERSONAL, WEB_SEARCH). Use dryRun=true for preview.