fix(backend): preserve generation lifecycle and knowledge source guards

[ActiveInAI]

Summary

This PR fixes two state invariant issues reported after PR #11:

• Rejecting a generation job from pending_review now also rejects the linked lifecycle transaction.
• Disabled knowledge sources can no longer be reactivated through ingest.
• Candidate-only vendor sources remain candidate-only and cannot become production-enabled through ingest.

Verification

• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all-targets --all-features
• cargo build --release --bin insomeos-gateway
• npx --yes @redocly/cli@2.30.0 lint 04-backend/openapi.yaml
• npx --yes @openapitools/openapi-generator-cli@2.23.0 generate -i 04-backend/openapi.yaml -g typescript-fetch -o /tmp/architoken-sdk-ts
• git diff --check