Access and entity words are core constants: access::*, entity::*

"owner"/"edit"/"view" and the entity names "note"/"label"/"attachment"/"preview"
were literals at about thirty sites across store, pull and push, including match
arms whose spelling had to agree with the rows a different module wrote.
models::access and models::entity now name them, and push names its two ops.
SQL text keeps its literals; Rust-side comparisons and writes read the constants.

DRY pass #2, batch 2, F7 (#5372).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

core/src/sync/pull.rs

@@ -13,6 +13,7 @@ use super::blobs::BlobStore;
 use super::client;
 use super::state;
 use super::wire;
+use crate::local::models::{access, entity};
 use crate::local::{now, Db};
 
 /// Backstop against a server that never stops saying `has_more`. At the server's
@@ -248,9 +249,9 @@ fn upsert_note(conn: &Connection, note: &wire::Note) -> rusqlite::Result<()> {
     // never changes, and the server's copy is the same value anyway.
     // A server without `shares` sends no permission, and every note it sends is ours.
     let permission = match note.permission.as_deref() {
-        Some("edit") => "edit",
-        Some("view") => "view",
-        _ => "owner",
+        Some(access::EDIT) => access::EDIT,
+        Some(access::VIEW) => access::VIEW,
+        _ => access::OWNER,
     };
     let (shared_by_id, shared_by_name) = match &note.shared_by {
         Some(by) => (Some(by.id.as_str()), Some(by.display_name.as_str())),
@@ -330,7 +331,7 @@ fn replace_attachments(conn: &Connection, note: &wire::Note) -> rusqlite::Result
         params![note.id],
     )?;
     for (index, att) in note.attachments.iter().enumerate() {
-        if removed_here(conn, "attachment", &att.id)? {
+        if removed_here(conn, entity::ATTACHMENT, &att.id)? {
             continue;
         }
         // The server listing an id this device is still waiting to upload means the