fix: don't auto-fill source with @username when empty

Both frontend and backend were defaulting the source field to
@username when left empty. Now stores an empty string instead.

Frontend (app.js):
- saveProtocol: removed || '@' + currentUser.username fallback
- saveCollection: removed || '@' + currentUser.username fallback

Backend (api/index.php):
- Protocol create: ['source'] ?? '' instead of ?? ('@' . username)
- Collection create: ['source'] ?? '' instead of ?? ('@' . username)

api/index.php

@@ -216,7 +216,7 @@ if ($parts[0] === 'protocols') {
                 'slug' => $new_slug,
                 'title' => substr($data['title'] ?? '', 0, 255),
                 'description' => $data['description'] ?? '',
-                'source' => $data['source'] ?? ('@' . $user['username']),
+                'source' => $data['source'] ?? '',
                 'source_url' => substr($data['source_url'] ?? '', 0, 500),
                 'tags' => json_encode(array_slice($data['tags'] ?? [], 0, 20)),
                 'forked_from' => $data['forked_from'] ?? null,
@@ -345,7 +345,7 @@ if ($parts[0] === 'collections') {
                 'slug' => $new_slug,
                 'title' => substr($data['title'] ?? '', 0, 255),
                 'description' => $data['description'] ?? '',
-                'source' => $data['source'] ?? ('@' . $user['username']),
+                'source' => $data['source'] ?? '',
                 'image' => $data['image'] ?? null,
                 'author_id' => $user['id'],
                 'visibility' => validate_visibility($data['visibility'] ?? 'public'),

frontend/app.js

@@ -536,7 +536,7 @@ async function saveProtocol(e) {
     title: form.title.value,
     description: form.description.value,
     tags: currentTags.slice(),
-    source: form.source.value || '@' + currentUser.username,
+    source: form.source.value,
     source_url: form.source_url.value,
     outcome: form.outcome.value,
     practice: form.practice.value,
@@ -710,7 +710,7 @@ async function saveCollection(e) {
   var data = {
     title: form['coll-title'].value,
     description: form['coll-description'].value,
-    source: form['coll-source'].value || '@' + currentUser.username,
+    source: form['coll-source'].value,
     visibility: form['coll-visibility'].value,
     items: collectionSelectedProtocols.map(function(slug) { return { type: 'protocol', slug: slug }; }),
   };