What is the best way to store sensitive information on the client?
What you want is basically impossible in this way. The crux of the matter is that if you want your application to access the encrypted data, your application needs to have the key in some shape or form. 

Due to the limitations you mentioned, this key needs to be on the client machine, in the application's code or data files.

There are several ways to hide a key in the application's data.  But that is really "security through obscurity", e.g. no security at all. Because it won't protect the key against a persistent attacker who could e.g. single-step through your application's assembly code in a debugger to see how it is accessing the database.

To keep out casual snoopers, you could just compress the database before writing it to disk. To make snooper's lives more difficult, you could chop off the identifying header that most compression programs employ.

BTW, the existence of virtual machines makes snooping on an application easier and harder to detect than ever before. There are some tricks to detect wether your program is running under a debugger, in which case you could abort the program. But if that machine is virtual, the attacker could stop the VM at any time and trawl through that VM's memory at his leisure without your program being any the wiser.

Another thing to keep in mind is authentication. How does the client authenticate to the server when it wants to retrieve a database update? In other words, what is stopping an attacker from impersonating your application and requesting a complete copy of the database?