TMS backfills should preserve source precision and recheck eligibility under lock

Reusable implementation lesson from COR-3970 / e3-solutions/theft PR #780: normalize only provider fields whose semantics are explicit, never synthesize an exact pickup timestamp from a date-only or late/actual fallback, and treat blank provider values as non-authoritative. For active-load backfills, fetch outside the transaction, then lock/reread and revalidate identity plus eligibility before updating the load context and derived dashboard projection in one transaction. Dry-run by default, bound concurrency and provider deadlines, checkpoint the UUID cursor, and return a nonzero exit for partial provider/apply failures. Provenance: COR-3970 implementation and four scoped code-review passes, commit ab16fdeb.