Remove final AppDatabase pass-through methods with ESLint guard (C1 part 3/3)

Migrate all remaining pass-through call sites (social, skills, budget,
entityCrud, documents, knowledge, automation, wakeup, backup, threads,
settings, snapshot, connectors, workspaces, activity) to their owning
domain modules. `AppDatabase` now carries only three methods:

  - createHireRequest (multi-module composite: agents + approvalsMod)
  - rollbackConfigRevision (multi-module composite: documents + entityCrud)
  - queryAll (raw-SQL escape hatch, @internal)

The vault/env-binding infrastructure previously passed argument-by-
argument into `entityCrud.saveSecret`/`resolveSecretEnv` now binds at
module construction, letting callers invoke `db.entityCrud.saveSecret({...})`
without carrying vault plumbing.

Structural types that narrowed AppDatabase to a bag of flat methods
(`ConnectorModelPolicyDeps` callers, `CapabilityMatchDb`, test mocks in
budget-enforcement / budget-incidents / task-quality-gates /
failure-escalation / task-quality-gates-sweep) are reshaped to the new
namespace. `connectorPolicyDepsFromDb` replaces the old pattern of
handing the whole AppDatabase to `validateConnectorModelSelection`.

A new ESLint rule in eslint.config.mjs blocks new top-level methods on
AppDatabase so the pass-through layer cannot silently grow back.
`AppDatabase.ts` dropped from 193 lines to 58; `AppDatabaseBase` lost
the 270-line trailing pass-through block.

src/main/orchestration/resolve-workspace.ts

@@ -31,28 +31,28 @@ export function resolveWorkspaceWithLockMode(
   agent: { workspaceId: string | null },
   companyId: string,
 ): {
-  workspace: ReturnType<AppDatabase["getWorkspace"]>;
+  workspace: ReturnType<AppDatabase["workspacesMod"]["getWorkspace"]>;
   lockMode: WorkspaceLockMode;
   source: "task" | "agent" | "project" | "company_fallback" | "none";
 } {
   if (task) {
-    const taskWorkspace = db.getWorkspace(task.workspaceId);
+    const taskWorkspace = db.workspacesMod.getWorkspace(task.workspaceId);
     if (taskWorkspace) {
       return { workspace: taskWorkspace, lockMode: "exclusive", source: "task" };
     }
   }
 
-  const agentWorkspace = db.getWorkspace(agent.workspaceId);
+  const agentWorkspace = db.workspacesMod.getWorkspace(agent.workspaceId);
   if (agentWorkspace) {
     return { workspace: agentWorkspace, lockMode: "exclusive", source: "agent" };
   }
 
-  const projectWorkspace = db.getProjectPrimaryWorkspace(task?.projectId ?? null, companyId);
+  const projectWorkspace = db.workspacesMod.getProjectPrimaryWorkspace(task?.projectId ?? null, companyId);
   if (projectWorkspace) {
     return { workspace: projectWorkspace, lockMode: "exclusive", source: "project" };
   }
 
-  const fallbackWorkspace = db.getAnyCompanyWorkspace(companyId);
+  const fallbackWorkspace = db.workspacesMod.getAnyCompanyWorkspace(companyId);
   if (fallbackWorkspace) {
     return { workspace: fallbackWorkspace, lockMode: "exclusive", source: "company_fallback" };
   }