Remove final AppDatabase pass-through methods with ESLint guard (C1 part 3/3)

Migrate all remaining pass-through call sites (social, skills, budget,
entityCrud, documents, knowledge, automation, wakeup, backup, threads,
settings, snapshot, connectors, workspaces, activity) to their owning
domain modules. `AppDatabase` now carries only three methods:

  - createHireRequest (multi-module composite: agents + approvalsMod)
  - rollbackConfigRevision (multi-module composite: documents + entityCrud)
  - queryAll (raw-SQL escape hatch, @internal)

The vault/env-binding infrastructure previously passed argument-by-
argument into `entityCrud.saveSecret`/`resolveSecretEnv` now binds at
module construction, letting callers invoke `db.entityCrud.saveSecret({...})`
without carrying vault plumbing.

Structural types that narrowed AppDatabase to a bag of flat methods
(`ConnectorModelPolicyDeps` callers, `CapabilityMatchDb`, test mocks in
budget-enforcement / budget-incidents / task-quality-gates /
failure-escalation / task-quality-gates-sweep) are reshaped to the new
namespace. `connectorPolicyDepsFromDb` replaces the old pattern of
handing the whole AppDatabase to `validateConnectorModelSelection`.

A new ESLint rule in eslint.config.mjs blocks new top-level methods on
AppDatabase so the pass-through layer cannot silently grow back.
`AppDatabase.ts` dropped from 193 lines to 58; `AppDatabaseBase` lost
the 270-line trailing pass-through block.

tests/unit/message-dispatch.test.ts

@@ -19,7 +19,7 @@ afterEach(async () => {
 });
 
 function createScaffold(db: AppDatabase) {
-  db.updateConnectorHealth({
+  db.connectorsCrud.updateConnectorHealth({
     id: "openai-codex",
     status: "ready",
     authState: "authenticated",
@@ -33,7 +33,7 @@ function createScaffold(db: AppDatabase) {
     status: "active",
     executionMode: "ai_cofounder",
   });
-  const workspaceId = db.saveWorkspace({
+  const workspaceId = db.workspacesMod.saveWorkspace({
     companyId,
     name: "Primary",
     localPath: "/tmp/message-dispatch",
@@ -282,7 +282,7 @@ describe("message dispatch", () => {
     });
 
     threadIntegration.onTaskCreated(taskId, companyId);
-    const thread = db.listThreads({
+    const thread = db.threads.listThreads({
       companyId,
       type: "task",
       relatedEntityType: "task",
@@ -294,21 +294,21 @@ describe("message dispatch", () => {
       throw new Error("Expected task thread to exist.");
     }
 
-    const replyWait = db.setThreadWaitState({
+    const replyWait = db.threads.setThreadWaitState({
       threadId: thread.id,
       companyId,
       waitingFor: "user_reply",
       relatedApprovalId: null,
       reason: "Reply needed",
     });
-    const reviewWait = db.setThreadWaitState({
+    const reviewWait = db.threads.setThreadWaitState({
       threadId: thread.id,
       companyId,
       waitingFor: "user_review",
       relatedApprovalId: null,
       reason: "Review needed",
     });
-    const approvalWait = db.setThreadWaitState({
+    const approvalWait = db.threads.setThreadWaitState({
       threadId: thread.id,
       companyId,
       waitingFor: "user_approval",
@@ -328,7 +328,7 @@ describe("message dispatch", () => {
       body: "Board-wide update",
     });
 
-    let unresolved = db.listThreadWaitStates(companyId);
+    let unresolved = db.threads.listThreadWaitStates(companyId);
     expect(unresolved.some((entry) => entry.id === replyWait.id)).toBe(false);
     expect(unresolved.some((entry) => entry.id === reviewWait.id)).toBe(true);
 
@@ -346,7 +346,7 @@ describe("message dispatch", () => {
       body: "Specific reply for the thread",
     });
 
-    unresolved = db.listThreadWaitStates(companyId);
+    unresolved = db.threads.listThreadWaitStates(companyId);
     expect(unresolved.some((entry) => entry.id === reviewWait.id)).toBe(false);
     expect(unresolved.some((entry) => entry.id === approvalWait.id)).toBe(true);