Remove final AppDatabase pass-through methods with ESLint guard (C1 part 3/3)

Migrate all remaining pass-through call sites (social, skills, budget,
entityCrud, documents, knowledge, automation, wakeup, backup, threads,
settings, snapshot, connectors, workspaces, activity) to their owning
domain modules. `AppDatabase` now carries only three methods:

  - createHireRequest (multi-module composite: agents + approvalsMod)
  - rollbackConfigRevision (multi-module composite: documents + entityCrud)
  - queryAll (raw-SQL escape hatch, @internal)

The vault/env-binding infrastructure previously passed argument-by-
argument into `entityCrud.saveSecret`/`resolveSecretEnv` now binds at
module construction, letting callers invoke `db.entityCrud.saveSecret({...})`
without carrying vault plumbing.

Structural types that narrowed AppDatabase to a bag of flat methods
(`ConnectorModelPolicyDeps` callers, `CapabilityMatchDb`, test mocks in
budget-enforcement / budget-incidents / task-quality-gates /
failure-escalation / task-quality-gates-sweep) are reshaped to the new
namespace. `connectorPolicyDepsFromDb` replaces the old pattern of
handing the whole AppDatabase to `validateConnectorModelSelection`.

A new ESLint rule in eslint.config.mjs blocks new top-level methods on
AppDatabase so the pass-through layer cannot silently grow back.
`AppDatabase.ts` dropped from 193 lines to 58; `AppDatabaseBase` lost
the 270-line trailing pass-through block.

src/main/orchestration/run-dispatch.ts

@@ -47,7 +47,15 @@ export function createRunDispatch(deps: OrchestrationDependencies) {
       logger.info(`[run] Agent ${agent.name} connector ${connector.id} blocked: ${issue}`);
       return "CONNECTOR_NOT_READY";
     }
-    const modelSelection = validateConnectorModelSelection(db, agent.companyId, connector.id, agent.model ?? null);
+    const modelSelection = validateConnectorModelSelection(
+      {
+        getConnector: (id) => db.connectorsCrud.getConnector(id),
+        getDisabledModels: (cid, connId) => db.settings.getDisabledModels(cid, connId),
+      },
+      agent.companyId,
+      connector.id,
+      agent.model ?? null,
+    );
     if (!modelSelection.ok) {
       logger.info(`[run] Agent ${agent.name} connector model blocked: ${modelSelection.error}`);
       return "CONNECTOR_MODEL_NOT_ALLOWED";
@@ -81,7 +89,7 @@ export function createRunDispatch(deps: OrchestrationDependencies) {
     if (
       params.workspaceMode === "exclusive" &&
       params.workspace &&
-      !db.claimWorkspaceLock(params.workspace.id, params.runId)
+      !db.workspacesMod.claimWorkspaceLock(params.workspace.id, params.runId)
     ) {
       db.runs.finishRun({
         runId: params.runId,