fix(lotw): keep another station's confirmations out, and show a suspect report

Unscoped, the report carries every station on the account — including the calls
belonging to another profile's logbook. Those match nothing here, and with 'add
the ones not found' ticked they would pour a second log into this one. The
station callsigns this logbook actually holds are now the filter: a portable
worked here is kept, an expedition call never used here is skipped and counted.

A near-empty report is also the failure that reads as success — 'matched 1 of 1'
where the account holds twelve thousand. Under 4 KB, what LoTW answered is shown
verbatim instead.

internal/qso/qso.go

@@ -2984,6 +2984,33 @@ func DedupeKey(callsign, qsoDateMinute, band, mode string) string {
 	return strings.ToUpper(callsign) + "|" + qsoDateMinute + "|" + strings.ToLower(band) + "|" + strings.ToUpper(mode)
 }
 
+// StationCallsigns lists the distinct station callsigns the logbook was worked
+// under, upper-cased and without the blanks.
+//
+// Used to decide whether a downloaded confirmation belongs to THIS log at all:
+// one LoTW account can hold several stations (a home call, a portable, an
+// expedition), and a confirmation for a station this logbook has never used is
+// somebody else's log — here, another profile's.
+func (r *Repo) StationCallsigns(ctx context.Context) (map[string]bool, error) {
+	rows, err := r.db.QueryContext(ctx,
+		`SELECT DISTINCT COALESCE(station_callsign,'') FROM qso`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := map[string]bool{}
+	for rows.Next() {
+		var c string
+		if err := rows.Scan(&c); err != nil {
+			return nil, err
+		}
+		if c = strings.ToUpper(strings.TrimSpace(c)); c != "" {
+			out[c] = true
+		}
+	}
+	return out, rows.Err()
+}
+
 // DedupeKeyIDs returns a map of dedupe key → QSO id, for matching downloaded
 // confirmations back to local QSOs.
 func (r *Repo) DedupeKeyIDs(ctx context.Context) (map[string]int64, error) {