Remove final AppDatabase pass-through methods with ESLint guard (C1 part 3/3)

Migrate all remaining pass-through call sites (social, skills, budget,
entityCrud, documents, knowledge, automation, wakeup, backup, threads,
settings, snapshot, connectors, workspaces, activity) to their owning
domain modules. `AppDatabase` now carries only three methods:

  - createHireRequest (multi-module composite: agents + approvalsMod)
  - rollbackConfigRevision (multi-module composite: documents + entityCrud)
  - queryAll (raw-SQL escape hatch, @internal)

The vault/env-binding infrastructure previously passed argument-by-
argument into `entityCrud.saveSecret`/`resolveSecretEnv` now binds at
module construction, letting callers invoke `db.entityCrud.saveSecret({...})`
without carrying vault plumbing.

Structural types that narrowed AppDatabase to a bag of flat methods
(`ConnectorModelPolicyDeps` callers, `CapabilityMatchDb`, test mocks in
budget-enforcement / budget-incidents / task-quality-gates /
failure-escalation / task-quality-gates-sweep) are reshaped to the new
namespace. `connectorPolicyDepsFromDb` replaces the old pattern of
handing the whole AppDatabase to `validateConnectorModelSelection`.

A new ESLint rule in eslint.config.mjs blocks new top-level methods on
AppDatabase so the pass-through layer cannot silently grow back.
`AppDatabase.ts` dropped from 193 lines to 58; `AppDatabaseBase` lost
the 270-line trailing pass-through block.

src/main/task-quality-gates.ts

@@ -28,8 +28,10 @@ interface CapabilityMatchDb {
   entityCrud: {
     getAgent(id: string): { name: string; capabilities: string };
   };
-  listAgentSkillAssignments(id: string): string[];
-  getCompanySkill(companyId: string, skillId: string): { name: string; description: string | null; slug: string } | null;
+  skills: {
+    listAgentSkillAssignments(id: string): string[];
+    getCompanySkill(companyId: string, skillId: string): { name: string; description: string | null; slug: string } | null;
+  };
 }
 
 
@@ -135,9 +137,9 @@ export function checkCapabilityMatch(
   const capabilityOverlap = taskWords.filter((w) => capWords.includes(w)).length;
 
   let skillOverlap = 0;
-  const skillIds = db.listAgentSkillAssignments(agentId);
+  const skillIds = db.skills.listAgentSkillAssignments(agentId);
   for (const skillId of skillIds) {
-    const skill = db.getCompanySkill(companyId, skillId);
+    const skill = db.skills.getCompanySkill(companyId, skillId);
     if (skill) {
       const skillWords = tokenize(`${skill.name} ${skill.description ?? ""} ${skill.slug}`);
       skillOverlap += taskWords.filter((w) => skillWords.includes(w)).length;