Remove final AppDatabase pass-through methods with ESLint guard (C1 part 3/3)

Migrate all remaining pass-through call sites (social, skills, budget,
entityCrud, documents, knowledge, automation, wakeup, backup, threads,
settings, snapshot, connectors, workspaces, activity) to their owning
domain modules. `AppDatabase` now carries only three methods:

  - createHireRequest (multi-module composite: agents + approvalsMod)
  - rollbackConfigRevision (multi-module composite: documents + entityCrud)
  - queryAll (raw-SQL escape hatch, @internal)

The vault/env-binding infrastructure previously passed argument-by-
argument into `entityCrud.saveSecret`/`resolveSecretEnv` now binds at
module construction, letting callers invoke `db.entityCrud.saveSecret({...})`
without carrying vault plumbing.

Structural types that narrowed AppDatabase to a bag of flat methods
(`ConnectorModelPolicyDeps` callers, `CapabilityMatchDb`, test mocks in
budget-enforcement / budget-incidents / task-quality-gates /
failure-escalation / task-quality-gates-sweep) are reshaped to the new
namespace. `connectorPolicyDepsFromDb` replaces the old pattern of
handing the whole AppDatabase to `validateConnectorModelSelection`.

A new ESLint rule in eslint.config.mjs blocks new top-level methods on
AppDatabase so the pass-through layer cannot silently grow back.
`AppDatabase.ts` dropped from 193 lines to 58; `AppDatabaseBase` lost
the 270-line trailing pass-through block.

src/main/skills/runtime.ts

@@ -35,9 +35,9 @@ export function createSkillRuntime({ db, logger, skillsRoot, skillFilesDir, impo
     agentId: string,
     _connectorId: string,
   ): ProjectedSkill[] {
-    const assignedIds = new Set(db.listAgentSkillAssignments(agentId));
+    const assignedIds = new Set(db.skills.listAgentSkillAssignments(agentId));
     if (assignedIds.size === 0) return [];
-    const companySkills = db.listCompanySkills(companyId);
+    const companySkills = db.skills.listCompanySkills(companyId);
     const skillPaths = companySkills
       .filter((s) => assignedIds.has(s.id))
       .map((s) => skillFilesDir(companyId, s.slug));
@@ -82,7 +82,7 @@ export function createSkillRuntime({ db, logger, skillsRoot, skillFilesDir, impo
       }
     }
 
-    const workspacePaths = db.listWorkspaceLocalPaths(companyId);
+    const workspacePaths = db.workspacesMod.listWorkspaceLocalPaths(companyId);
     for (const wsPath of workspacePaths) {
       const agentcompanySkillsDir = join(wsPath, ".agentcompany", "skills");
       if (!existsSync(agentcompanySkillsDir)) continue;
@@ -159,12 +159,12 @@ export function createSkillRuntime({ db, logger, skillsRoot, skillFilesDir, impo
         const results = await importFromLocal(companyId, categoryDir);
         for (const result of results) {
           try {
-            const skill = db.getCompanySkill(companyId, result.skillId);
+            const skill = db.skills.getCompanySkill(companyId, result.skillId);
             if (skill) {
               const existingMeta = skill.metadata ? JSON.parse(typeof skill.metadata === "string" ? skill.metadata : JSON.stringify(skill.metadata)) : {};
               existingMeta.builtinCategory = category;
               existingMeta.sourceKind = "builtin";
-              db.updateCompanySkillMetadata(companyId, result.skillId, JSON.stringify(existingMeta));
+              db.skills.updateCompanySkillMetadata(companyId, result.skillId, JSON.stringify(existingMeta));
             }
           } catch (error) {
             logger.warn(