Remove final AppDatabase pass-through methods with ESLint guard (C1 part 3/3)

Migrate all remaining pass-through call sites (social, skills, budget,
entityCrud, documents, knowledge, automation, wakeup, backup, threads,
settings, snapshot, connectors, workspaces, activity) to their owning
domain modules. `AppDatabase` now carries only three methods:

  - createHireRequest (multi-module composite: agents + approvalsMod)
  - rollbackConfigRevision (multi-module composite: documents + entityCrud)
  - queryAll (raw-SQL escape hatch, @internal)

The vault/env-binding infrastructure previously passed argument-by-
argument into `entityCrud.saveSecret`/`resolveSecretEnv` now binds at
module construction, letting callers invoke `db.entityCrud.saveSecret({...})`
without carrying vault plumbing.

Structural types that narrowed AppDatabase to a bag of flat methods
(`ConnectorModelPolicyDeps` callers, `CapabilityMatchDb`, test mocks in
budget-enforcement / budget-incidents / task-quality-gates /
failure-escalation / task-quality-gates-sweep) are reshaped to the new
namespace. `connectorPolicyDepsFromDb` replaces the old pattern of
handing the whole AppDatabase to `validateConnectorModelSelection`.

A new ESLint rule in eslint.config.mjs blocks new top-level methods on
AppDatabase so the pass-through layer cannot silently grow back.
`AppDatabase.ts` dropped from 193 lines to 58; `AppDatabaseBase` lost
the 270-line trailing pass-through block.

src/main/service-graph/create-desktop-shell.ts

@@ -66,13 +66,13 @@ export function createDesktopShell({
         properties: ["openDirectory", "createDirectory"],
       }));
       if (target.canceled || target.filePaths.length === 0) return;
-      await db.exportBackup(`${target.filePaths[0]!}/agentcompany-backup-${Date.now()}`);
+      await db.backupMod.exportBackup(`${target.filePaths[0]!}/agentcompany-backup-${Date.now()}`);
     },
     onShortcut: (action) => emitEvent({ type: "shortcut", action }),
     notify,
     getActiveRunCount: () => {
       try {
-        const snapshot = db.listSnapshot();
+        const snapshot = db.snap.listSnapshot();
         return snapshot.runs.filter((r) => r.status === "running" || r.status === "queued").length;
       } catch (error) {
         logger.warn("[service-graph] getActiveRunCount failed:", error);

src/main/service-graph/create-lifecycle.ts

@@ -69,7 +69,7 @@ export function createLifecycle(deps: LifecycleDeps) {
 
   function listActiveRunIds(): string[] {
     try {
-      return db.listSnapshot().runs
+      return db.snap.listSnapshot().runs
         .filter((r) => r.status === "running" || r.status === "queued")
         .map((r) => r.id);
     } catch (err) {