core, desktop: Db::conn everywhere, Change::default, notes_where, and shared row mappings

From the audit (#5179, core and desktop half).

- Every `db.0.lock().map_err(|e| e.to_string())?` (about 50 sites in core and
  the desktop) is now `db.conn()?`. The few sites that deliberately handle
  a poisoned lock differently, and the tests, keep their own spelling.
- push::Change derives Default, so its four constructors name only the
  fields they set.
- store: list_notes, reminders, titles and search share notes_where (ids
  from a query, each loaded through load_note). Labels share
  LABEL_SELECT/label_row, and saved filters share
  SAVED_FILTER_SELECT/saved_filter_row.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

core/src/local/mod.rs

@@ -26,12 +26,9 @@ pub struct Db(pub Mutex<Connection>);
 impl Db {
     /// Lock the store, reporting a poisoned lock as a message rather than a panic.
     ///
-    /// Every consumer was writing `db.0.lock().map_err(|e| e.to_string())?` at each
-    /// call site. Beyond the repetition, that spelling forces the caller to NAME
-    /// `rusqlite::Connection` in any helper that returns the guard — which would make
-    /// rusqlite a dependency of a layer whose whole point is not to know what the
-    /// store is made of. Returning it from here means callers can bind the guard by
-    /// inference and never name the type.
+    /// The one way every caller takes the lock. Returning the guard from here lets a
+    /// caller bind it by inference without naming `rusqlite::Connection`, so layers
+    /// above the store need not depend on what it is made of.
     ///
     /// A poisoned lock means some earlier call panicked while holding it. The store
     /// is not necessarily corrupt, but this connection can't be trusted blind, so it