Remove final AppDatabase pass-through methods with ESLint guard (C1 part 3/3)

Migrate all remaining pass-through call sites (social, skills, budget,
entityCrud, documents, knowledge, automation, wakeup, backup, threads,
settings, snapshot, connectors, workspaces, activity) to their owning
domain modules. `AppDatabase` now carries only three methods:

  - createHireRequest (multi-module composite: agents + approvalsMod)
  - rollbackConfigRevision (multi-module composite: documents + entityCrud)
  - queryAll (raw-SQL escape hatch, @internal)

The vault/env-binding infrastructure previously passed argument-by-
argument into `entityCrud.saveSecret`/`resolveSecretEnv` now binds at
module construction, letting callers invoke `db.entityCrud.saveSecret({...})`
without carrying vault plumbing.

Structural types that narrowed AppDatabase to a bag of flat methods
(`ConnectorModelPolicyDeps` callers, `CapabilityMatchDb`, test mocks in
budget-enforcement / budget-incidents / task-quality-gates /
failure-escalation / task-quality-gates-sweep) are reshaped to the new
namespace. `connectorPolicyDepsFromDb` replaces the old pattern of
handing the whole AppDatabase to `validateConnectorModelSelection`.

A new ESLint rule in eslint.config.mjs blocks new top-level methods on
AppDatabase so the pass-through layer cannot silently grow back.
`AppDatabase.ts` dropped from 193 lines to 58; `AppDatabaseBase` lost
the 270-line trailing pass-through block.

src/main/database/entity-crud.ts

@@ -43,8 +43,12 @@ export function buildEntityCrudMethods(
   transaction: Transaction,
   _deps: {
     addActivity: (input: { companyId: string; actor: string; action: string; entityType: string; entityId: string; detail: string }) => void;
+    vault: { encrypt: (v: string) => { backend: string; payload: Uint8Array }; decrypt: (backend: "safe_storage" | "vault", ciphertext: Buffer) => string };
+    listInvalidEnvBindingKeys: (t: string) => string[];
+    parseEnvBindingText: (t: string) => Record<string, string>;
   },
 ) {
+  const { vault, listInvalidEnvBindingKeys, parseEnvBindingText } = _deps;
   return {
     getTask(id: string): TaskRecord {
       const row = getDb()
@@ -169,7 +173,7 @@ export function buildEntityCrudMethods(
       return id;
     },
 
-    saveSecret(input: { id?: string | null; companyId: string; name: string; description: string; value: string }, vault: { encrypt: (v: string) => { backend: string; payload: Uint8Array } }) {
+    saveSecret(input: { id?: string | null; companyId: string; name: string; description: string; value: string }) {
       const id = ensureId(input.id ?? null);
       const encrypted = vault.encrypt(input.value);
       const ts = nowIso();
@@ -191,7 +195,7 @@ export function buildEntityCrudMethods(
       return id;
     },
 
-    resolveSecretEnv(bindingText: string, companyId: string, vault: { decrypt: (backend: "safe_storage" | "vault", ciphertext: Buffer) => string }, listInvalidEnvBindingKeys: (t: string) => string[], parseEnvBindingText: (t: string) => Record<string, string>): Record<string, string> {
+    resolveSecretEnv(bindingText: string, companyId: string): Record<string, string> {
       const invalidKeys = new Set(listInvalidEnvBindingKeys(bindingText));
       const bindings = parseEnvBindingText(bindingText);
       const result: Record<string, string> = {};