Remove final AppDatabase pass-through methods with ESLint guard (C1 part 3/3)

Migrate all remaining pass-through call sites (social, skills, budget,
entityCrud, documents, knowledge, automation, wakeup, backup, threads,
settings, snapshot, connectors, workspaces, activity) to their owning
domain modules. `AppDatabase` now carries only three methods:

  - createHireRequest (multi-module composite: agents + approvalsMod)
  - rollbackConfigRevision (multi-module composite: documents + entityCrud)
  - queryAll (raw-SQL escape hatch, @internal)

The vault/env-binding infrastructure previously passed argument-by-
argument into `entityCrud.saveSecret`/`resolveSecretEnv` now binds at
module construction, letting callers invoke `db.entityCrud.saveSecret({...})`
without carrying vault plumbing.

Structural types that narrowed AppDatabase to a bag of flat methods
(`ConnectorModelPolicyDeps` callers, `CapabilityMatchDb`, test mocks in
budget-enforcement / budget-incidents / task-quality-gates /
failure-escalation / task-quality-gates-sweep) are reshaped to the new
namespace. `connectorPolicyDepsFromDb` replaces the old pattern of
handing the whole AppDatabase to `validateConnectorModelSelection`.

A new ESLint rule in eslint.config.mjs blocks new top-level methods on
AppDatabase so the pass-through layer cannot silently grow back.
`AppDatabase.ts` dropped from 193 lines to 58; `AppDatabaseBase` lost
the 270-line trailing pass-through block.

src/main/messaging/dispatch.ts

@@ -134,7 +134,7 @@ export function validateAgentMessageInput(
   input: NormalizedAgentMessageInput,
 ): MessageValidationError | null {
   // Human sender (BOARD_READER_ID) is always a valid sender — skip agent ownership check.
-  if (!input.fromHumanUser && !db.belongsToCompany("agents", input.fromAgentId, input.companyId)) {
+  if (!input.fromHumanUser && !db.settings.belongsToCompany("agents", input.fromAgentId, input.companyId)) {
     return {
       code: "INVALID_COMPANY_REFERENCE",
       message: "The message sender does not belong to the current company.",
@@ -154,7 +154,7 @@ export function validateAgentMessageInput(
     };
   }
 
-  if (input.toAgentId && input.toAgentId !== HUMAN_SENDER_ID && !db.belongsToCompany("agents", input.toAgentId, input.companyId)) {
+  if (input.toAgentId && input.toAgentId !== HUMAN_SENDER_ID && !db.settings.belongsToCompany("agents", input.toAgentId, input.companyId)) {
     return {
       code: "INVALID_COMPANY_REFERENCE",
       message: "The message recipient does not belong to the current company.",
@@ -168,7 +168,7 @@ export function validateAgentMessageInput(
         message: "Project messages require a project channel target.",
       };
     }
-    if (!db.belongsToCompany("projects", input.channelTargetId, input.companyId)) {
+    if (!db.settings.belongsToCompany("projects", input.channelTargetId, input.companyId)) {
       return {
         code: "INVALID_COMPANY_REFERENCE",
         message: "The selected project channel does not belong to the current company.",
@@ -201,7 +201,7 @@ function resolveProjectWakeTargets(
   input: NormalizedAgentMessageInput,
 ): string[] {
   if (!input.channelTargetId) return [];
-  const project = db.getProjectForUpdate(input.channelTargetId, input.companyId);
+  const project = db.entityCrud.getProjectForUpdate(input.channelTargetId, input.companyId);
   const participantIds = new Set<string>();
   if (project?.leadAgentId) participantIds.add(project.leadAgentId);
   for (const assigneeId of db.tasks.listProjectTaskAssigneeIds(input.channelTargetId, input.companyId)) {
@@ -367,7 +367,7 @@ export function dispatchAgentMessage(
         continue;
       }
       const runId = deps.wakeAgentIfPossible(wakeTarget, normalized.companyId, wakeTrigger);
-      const hasQueuedWake = !runId && deps.db.listWakeupRequests(normalized.companyId, {
+      const hasQueuedWake = !runId && deps.db.wakeup.listWakeupRequests(normalized.companyId, {
         agentId: wakeTarget,
         limit: 10,
       }).some((request) => request.status === "queued" || request.status === "deferred");