fix(queryer): restrict polymorphic bounds compiler to forward edges only

Resolves a query compilation bug in JSPG where reverse/incoming polymorphic
edges (where edge.forward == false, e.g. pet ➡️ cover_attachment) mistakenly
appended the destination type constraint to the parent query's WHERE clause
(e.g., producing `entity_1.type = 'attachment'` on a pet entity query,
causing it to match 0 rows and return null).

- Modifies `compile_polymorphic_bounds` in `compiler.rs` to only compile
  type checks when `edge.forward` is true. For reverse edges, the parent's
  type check does not belong on the parent table and is already implicitly
  restricted by parent ID joins.
- Updates the `fk_attachment_attachable_entity` relation in the queryer test
  fixture to correctly model a two-column polymorphic relation, ensuring
  this code path is exercised by the unit test suite.

src/queryer/compiler.rs

@@ -621,9 +621,6 @@ impl<'a> Compiler<'a> {
                   if edge.forward && relation.source_columns.len() > 1 {
                     poly_col = Some(&relation.source_columns[1]); // e.g., target_type
                     table_to_alias = &relation.source_type; // e.g., relationship
-                  } else if !edge.forward && relation.destination_columns.len() > 1 {
-                    poly_col = Some(&relation.destination_columns[1]); // e.g., source_type
-                    table_to_alias = &relation.destination_type; // e.g., relationship
                   }
 
                   if let Some(col) = poly_col {