Remove final AppDatabase pass-through methods with ESLint guard (C1 part 3/3)

Migrate all remaining pass-through call sites (social, skills, budget,
entityCrud, documents, knowledge, automation, wakeup, backup, threads,
settings, snapshot, connectors, workspaces, activity) to their owning
domain modules. `AppDatabase` now carries only three methods:

  - createHireRequest (multi-module composite: agents + approvalsMod)
  - rollbackConfigRevision (multi-module composite: documents + entityCrud)
  - queryAll (raw-SQL escape hatch, @internal)

The vault/env-binding infrastructure previously passed argument-by-
argument into `entityCrud.saveSecret`/`resolveSecretEnv` now binds at
module construction, letting callers invoke `db.entityCrud.saveSecret({...})`
without carrying vault plumbing.

Structural types that narrowed AppDatabase to a bag of flat methods
(`ConnectorModelPolicyDeps` callers, `CapabilityMatchDb`, test mocks in
budget-enforcement / budget-incidents / task-quality-gates /
failure-escalation / task-quality-gates-sweep) are reshaped to the new
namespace. `connectorPolicyDepsFromDb` replaces the old pattern of
handing the whole AppDatabase to `validateConnectorModelSelection`.

A new ESLint rule in eslint.config.mjs blocks new top-level methods on
AppDatabase so the pass-through layer cannot silently grow back.
`AppDatabase.ts` dropped from 193 lines to 58; `AppDatabaseBase` lost
the 270-line trailing pass-through block.

tests/integration/skill-aware-assignment.spec.ts

@@ -24,7 +24,7 @@ describe("skill-aware capability registry", () => {
     const db = new AppDatabase(profileDir);
     db.init();
 
-    db.updateConnectorHealth({
+    db.connectorsCrud.updateConnectorHealth({
       id: "openai-codex",
       status: "ready",
       authState: "authenticated",
@@ -37,7 +37,7 @@ describe("skill-aware capability registry", () => {
       description: "Tests skill-aware assignment",
       status: "active",
     });
-    const workspaceId = db.saveWorkspace({
+    const workspaceId = db.workspacesMod.saveWorkspace({
       companyId,
       name: "Primary",
       localPath: profileDir,
@@ -75,7 +75,7 @@ describe("skill-aware capability registry", () => {
 
     const skillId = randomUUID();
     const now = new Date().toISOString();
-    db.upsertCompanySkill({
+    db.skills.upsertCompanySkill({
       id: skillId,
       companyId,
       key: "frontend/react-ui",
@@ -92,7 +92,7 @@ describe("skill-aware capability registry", () => {
       createdAt: now,
       updatedAt: now,
     });
-    db.assignSkillToAgent(styledEngineerId, skillId);
+    db.skills.assignSkillToAgent(styledEngineerId, skillId);
 
     const taskId = db.tasks.saveTask({
       companyId,
@@ -114,7 +114,7 @@ describe("skill-aware capability registry", () => {
     const db = new AppDatabase(profileDir);
     db.init();
 
-    db.updateConnectorHealth({
+    db.connectorsCrud.updateConnectorHealth({
       id: "openai-codex",
       status: "ready",
       authState: "authenticated",
@@ -127,7 +127,7 @@ describe("skill-aware capability registry", () => {
       description: "Tests capability registry prompt injection",
       status: "active",
     });
-    const workspaceId = db.saveWorkspace({
+    const workspaceId = db.workspacesMod.saveWorkspace({
       companyId,
       name: "Primary",
       localPath: profileDir,
@@ -151,7 +151,7 @@ describe("skill-aware capability registry", () => {
 
     const skillId = randomUUID();
     const now = new Date().toISOString();
-    db.upsertCompanySkill({
+    db.skills.upsertCompanySkill({
       id: skillId,
       companyId,
       key: "frontend/react-ui",
@@ -169,7 +169,7 @@ describe("skill-aware capability registry", () => {
       updatedAt: now,
     });
 
-    const snapshot = db.listSnapshot();
+    const snapshot = db.snap.listSnapshot();
     const prompt = buildTaskPrompt({
       agent: db.entityCrud.getAgent(agentId),
       apiUrl: "http://127.0.0.1:3210",
@@ -193,7 +193,7 @@ describe("skill-aware capability registry", () => {
       allConnectors: snapshot.connectors
         .filter((connector) => connector.id === "openai-codex")
         .map((connector) => ({ id: connector.id, label: connector.label, status: connector.status, enabledModels: ["gpt-5.4"] })),
-      companySkillCatalog: db.listCompanySkills(companyId).map((skill) => ({
+      companySkillCatalog: db.skills.listCompanySkills(companyId).map((skill) => ({
         name: skill.name,
         slug: skill.slug,
         description: skill.description,