Remove final AppDatabase pass-through methods with ESLint guard (C1 part 3/3)

Migrate all remaining pass-through call sites (social, skills, budget,
entityCrud, documents, knowledge, automation, wakeup, backup, threads,
settings, snapshot, connectors, workspaces, activity) to their owning
domain modules. `AppDatabase` now carries only three methods:

  - createHireRequest (multi-module composite: agents + approvalsMod)
  - rollbackConfigRevision (multi-module composite: documents + entityCrud)
  - queryAll (raw-SQL escape hatch, @internal)

The vault/env-binding infrastructure previously passed argument-by-
argument into `entityCrud.saveSecret`/`resolveSecretEnv` now binds at
module construction, letting callers invoke `db.entityCrud.saveSecret({...})`
without carrying vault plumbing.

Structural types that narrowed AppDatabase to a bag of flat methods
(`ConnectorModelPolicyDeps` callers, `CapabilityMatchDb`, test mocks in
budget-enforcement / budget-incidents / task-quality-gates /
failure-escalation / task-quality-gates-sweep) are reshaped to the new
namespace. `connectorPolicyDepsFromDb` replaces the old pattern of
handing the whole AppDatabase to `validateConnectorModelSelection`.

A new ESLint rule in eslint.config.mjs blocks new top-level methods on
AppDatabase so the pass-through layer cannot silently grow back.
`AppDatabase.ts` dropped from 193 lines to 58; `AppDatabaseBase` lost
the 270-line trailing pass-through block.

src/main/ipc-core-task-graph-handlers.ts

@@ -43,8 +43,8 @@ export function registerCoreTaskGraphHandlers({
     if (invalidReference) {
       return fail("INVALID_COMPANY_REFERENCE", `The selected ${invalidReference.label} does not belong to the current company.`);
     }
-    const id = db.saveGoal(parsed);
-    db.addActivity({
+    const id = db.entityCrud.saveGoal(parsed);
+    db.activityMod.addActivity({
       companyId: parsed.companyId,
       actor: "board",
       action: parsed.id ? "goal.updated" : "goal.created",
@@ -70,8 +70,8 @@ export function registerCoreTaskGraphHandlers({
     if (invalidReference) {
       return fail("INVALID_COMPANY_REFERENCE", `The selected ${invalidReference.label} does not belong to the current company.`);
     }
-    const id = db.saveProject(parsed);
-    db.addActivity({
+    const id = db.entityCrud.saveProject(parsed);
+    db.activityMod.addActivity({
       companyId: parsed.companyId,
       actor: "board",
       action: parsed.id ? "project.updated" : "project.created",
@@ -128,7 +128,7 @@ export function registerCoreTaskGraphHandlers({
     } catch (error) {
       return fail("INVALID_TASK_STATE", error instanceof Error ? error.message : "Task could not be saved.");
     }
-    db.addActivity({
+    db.activityMod.addActivity({
       companyId: parsed.companyId,
       actor: "board",
       action: isNew ? "task.created" : "task.updated",
@@ -176,9 +176,9 @@ export function registerCoreTaskGraphHandlers({
 
   const deleteHandlers = [
     { channel: IPC_CHANNELS.deleteTask, table: "tasks", entity: "task", deleteFn: (id: string, companyId: string) => db.tasks.deleteTask(id, companyId) },
-    { channel: IPC_CHANNELS.deleteGoal, table: "goals", entity: "goal", deleteFn: (id: string, companyId: string) => db.deleteGoal(id, companyId) },
-    { channel: IPC_CHANNELS.deleteProject, table: "projects", entity: "project", deleteFn: (id: string, companyId: string) => db.deleteProject(id, companyId) },
-    { channel: IPC_CHANNELS.deleteWorkspace, table: "workspaces", entity: "workspace", deleteFn: (id: string, companyId: string) => db.deleteWorkspace(id, companyId) },
+    { channel: IPC_CHANNELS.deleteGoal, table: "goals", entity: "goal", deleteFn: (id: string, companyId: string) => db.entityCrud.deleteGoal(id, companyId) },
+    { channel: IPC_CHANNELS.deleteProject, table: "projects", entity: "project", deleteFn: (id: string, companyId: string) => db.entityCrud.deleteProject(id, companyId) },
+    { channel: IPC_CHANNELS.deleteWorkspace, table: "workspaces", entity: "workspace", deleteFn: (id: string, companyId: string) => db.workspacesMod.deleteWorkspace(id, companyId) },
   ] as const;
 
   for (const { channel, table, entity, deleteFn } of deleteHandlers) {
@@ -186,11 +186,11 @@ export function registerCoreTaskGraphHandlers({
       const parsed = deleteEntitySchema.parse(payload);
       const companyError = ensureCompanyExists(parsed.companyId);
       if (companyError) return companyError;
-      if (!db.belongsToCompany(table, parsed.id, parsed.companyId)) {
+      if (!db.settings.belongsToCompany(table, parsed.id, parsed.companyId)) {
         return fail(`${entity.toUpperCase()}_NOT_FOUND`, `${entity.charAt(0).toUpperCase() + entity.slice(1)} not found in the current company.`);
       }
       deleteFn(parsed.id, parsed.companyId);
-      db.addActivity({
+      db.activityMod.addActivity({
         companyId: parsed.companyId,
         actor: "board",
         action: `${entity}.deleted`,