core, desktop: Db::conn everywhere, Change::default, notes_where, and shared row mappings

From the audit (#5179, core and desktop half).

- Every `db.0.lock().map_err(|e| e.to_string())?` (about 50 sites in core and
  the desktop) is now `db.conn()?`. The few sites that deliberately handle
  a poisoned lock differently, and the tests, keep their own spelling.
- push::Change derives Default, so its four constructors name only the
  fields they set.
- store: list_notes, reminders, titles and search share notes_where (ids
  from a query, each loaded through load_note). Labels share
  LABEL_SELECT/label_row, and saved filters share
  SAVED_FILTER_SELECT/saved_filter_row.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

desktop/src-tauri/src/autosync.rs

@@ -175,7 +175,7 @@ fn backoff(failures: u32) -> Duration {
 
 /// The server URL and token, or None when this device isn't linked.
 fn credentials(db: &Db) -> Result<Option<(String, String)>, String> {
-    let conn = db.0.lock().map_err(|e| e.to_string())?;
+    let conn = db.conn()?;
     let current = state::read(&conn).map_err(|e| e.to_string())?;
     Ok(current.server_url.zip(current.device_token))
 }
@@ -183,7 +183,7 @@ fn credentials(db: &Db) -> Result<Option<(String, String)>, String> {
 /// What is waiting to be sent, as [`push::pending_fingerprint`] sees it. A store
 /// that can't be read reads as nothing pending; the periodic cycle still runs.
 fn pending(db: &Db) -> Option<String> {
-    let conn = db.0.lock().ok()?;
+    let conn = db.conn().ok()?;
     push::pending_fingerprint(&conn).ok().flatten()
 }