fix: don't auto-fill source with @username when empty

Both frontend and backend were defaulting the source field to
@username when left empty. Now stores an empty string instead.

Frontend (app.js):
- saveProtocol: removed || '@' + currentUser.username fallback
- saveCollection: removed || '@' + currentUser.username fallback

Backend (api/index.php):
- Protocol create: ['source'] ?? '' instead of ?? ('@' . username)
- Collection create: ['source'] ?? '' instead of ?? ('@' . username)

frontend/app.js

@@ -536,7 +536,7 @@ async function saveProtocol(e) {
     title: form.title.value,
     description: form.description.value,
     tags: currentTags.slice(),
-    source: form.source.value || '@' + currentUser.username,
+    source: form.source.value,
     source_url: form.source_url.value,
     outcome: form.outcome.value,
     practice: form.practice.value,
@@ -710,7 +710,7 @@ async function saveCollection(e) {
   var data = {
     title: form['coll-title'].value,
     description: form['coll-description'].value,
-    source: form['coll-source'].value || '@' + currentUser.username,
+    source: form['coll-source'].value,
     visibility: form['coll-visibility'].value,
     items: collectionSelectedProtocols.map(function(slug) { return { type: 'protocol', slug: slug }; }),
   };