Remove final AppDatabase pass-through methods with ESLint guard (C1 part 3/3)

Migrate all remaining pass-through call sites (social, skills, budget,
entityCrud, documents, knowledge, automation, wakeup, backup, threads,
settings, snapshot, connectors, workspaces, activity) to their owning
domain modules. `AppDatabase` now carries only three methods:

  - createHireRequest (multi-module composite: agents + approvalsMod)
  - rollbackConfigRevision (multi-module composite: documents + entityCrud)
  - queryAll (raw-SQL escape hatch, @internal)

The vault/env-binding infrastructure previously passed argument-by-
argument into `entityCrud.saveSecret`/`resolveSecretEnv` now binds at
module construction, letting callers invoke `db.entityCrud.saveSecret({...})`
without carrying vault plumbing.

Structural types that narrowed AppDatabase to a bag of flat methods
(`ConnectorModelPolicyDeps` callers, `CapabilityMatchDb`, test mocks in
budget-enforcement / budget-incidents / task-quality-gates /
failure-escalation / task-quality-gates-sweep) are reshaped to the new
namespace. `connectorPolicyDepsFromDb` replaces the old pattern of
handing the whole AppDatabase to `validateConnectorModelSelection`.

A new ESLint rule in eslint.config.mjs blocks new top-level methods on
AppDatabase so the pass-through layer cannot silently grow back.
`AppDatabase.ts` dropped from 193 lines to 58; `AppDatabaseBase` lost
the 270-line trailing pass-through block.

src/main/agent-runtime/artifact-projector.ts

@@ -323,7 +323,7 @@ function retireDeletedArtifacts(
   deleted: string[],
 ): ProjectionOutcome[] {
   if (deleted.length === 0) return [];
-  const archived = db.archiveWorkProductsByExternalPaths({
+  const archived = db.documentsMod.archiveWorkProductsByExternalPaths({
     companyId: ctx.companyId,
     workspaceId: ctx.workspaceId,
     provider: "filesystem",
@@ -608,13 +608,13 @@ function upsertFilesystemArtifact(
   // Every touch refreshes `last_touched_by_run_id` so the deliverable
   // signal, the DocumentCenter preview, and the run-provenance readers
   // all see the latest run that wrote the file.
-  const existing = db.findWorkProductByExternalId(ctx.companyId, provider, relativePath, ctx.workspaceId);
+  const existing = db.documentsMod.findWorkProductByExternalId(ctx.companyId, provider, relativePath, ctx.workspaceId);
   if (existing) {
     // `status: "active"` flips a previously-archived row (earlier run
     // retired the path, this run recreated it) back into the visible
     // DocumentCenter set. `lastTouchedByRunId` keeps the provenance
     // timeline pointed at the run that just wrote the bytes.
-    db.updateWorkProduct(existing.id, ctx.companyId, {
+    db.documentsMod.updateWorkProduct(existing.id, ctx.companyId, {
       title,
       status: "active",
       lastTouchedByRunId: ctx.runId,
@@ -622,7 +622,7 @@ function upsertFilesystemArtifact(
     });
     return { kind: "updated", workProductId: existing.id, relativePath };
   }
-  const workProductId = db.createWorkProduct({
+  const workProductId = db.documentsMod.createWorkProduct({
     companyId: ctx.companyId,
     taskId: ctx.taskId,
     workspaceId: ctx.workspaceId,

src/main/agent-runtime/runtime-bridge.ts

@@ -358,7 +358,7 @@ export class RuntimeBridge {
     try {
       const body = extractTextBody(message.content);
       const actor = this.resolveThreadEventActor(envelope, message);
-      this.deps.db.addThreadEvent({
+      this.deps.db.threads.addThreadEvent({
         threadId: thread.id,
         actorId: actor.actorId,
         actorType: actor.actorType,
@@ -470,7 +470,7 @@ export class RuntimeBridge {
           : record.senderKind === "system"
             ? "system"
             : "agent";
-      this.deps.db.addThreadEvent({
+      this.deps.db.threads.addThreadEvent({
         threadId: thread.id,
         actorId: record.fromAgentId,
         actorType,