WL-0MM8V5SF11MGNQNM: Audit db.import() call sites and add safety docs

[rgardler-msft]

Summary

• Adds detailed JSDoc to db.import() in src/database.ts warning it is destructive (clears all items before inserting) and recommending upsertItems() for partial updates.
• Adds inline // SAFETY: comments at all 5 remaining db.import() call sites documenting why each usage is safe.

Audit results

All 5 remaining db.import() call sites pass complete item sets — no unsafe callers found:

File	Line	Input	Verdict
src/commands/sync.ts	181	Full merged set (local + remote)	Safe
src/commands/import.ts	25	Full JSONL file contents (intentional replace)	Safe
src/commands/init.ts	860	Full merged set (local + remote)	Safe
src/api.ts	412	Full JSONL file contents (intentional replace)	Safe
src/index.ts	58	Full merged set (local + remote)	Safe

The 4 previously-unsafe call sites in src/commands/github.ts were already fixed in PR #789 (replaced with upsertItems()).

Context

Final task (Feature 4 of 4) for critical data-loss bug WL-0MM8RQOC902W3LM5:

1. WL-0MM8V4UPC02YMFXK - Add db.upsertItems() API (PR WL-0MM8V4UPC02YMFXK: Add non-destructive db.upsertItems() API #788, merged)
2. WL-0MM8V55PV1Q32K7D - Replace db.import() with db.upsertItems() in GitHub flows (PR WL-0MM8V55PV1Q32K7D: Fix destructive db.import() in GitHub flows #789, merged)
3. WL-0MM8V5GTH06V9Z0P - Update mock-based tests to expose destructive behavior (PR WL-0MM8V5GTH06V9Z0P: Make delegate mock destructive and add preservation test #790, merged)
4. WL-0MM8V5SF11MGNQNM - Audit db.import() call sites and add safety docs (this PR)

Test results

• Full test suite: 95 files, 1214 tests pass, 0 failures
• Changes are comment/doc-only, no behavioral changes