Remove final AppDatabase pass-through methods with ESLint guard (C1 part 3/3)

Migrate all remaining pass-through call sites (social, skills, budget,
entityCrud, documents, knowledge, automation, wakeup, backup, threads,
settings, snapshot, connectors, workspaces, activity) to their owning
domain modules. `AppDatabase` now carries only three methods:

  - createHireRequest (multi-module composite: agents + approvalsMod)
  - rollbackConfigRevision (multi-module composite: documents + entityCrud)
  - queryAll (raw-SQL escape hatch, @internal)

The vault/env-binding infrastructure previously passed argument-by-
argument into `entityCrud.saveSecret`/`resolveSecretEnv` now binds at
module construction, letting callers invoke `db.entityCrud.saveSecret({...})`
without carrying vault plumbing.

Structural types that narrowed AppDatabase to a bag of flat methods
(`ConnectorModelPolicyDeps` callers, `CapabilityMatchDb`, test mocks in
budget-enforcement / budget-incidents / task-quality-gates /
failure-escalation / task-quality-gates-sweep) are reshaped to the new
namespace. `connectorPolicyDepsFromDb` replaces the old pattern of
handing the whole AppDatabase to `validateConnectorModelSelection`.

A new ESLint rule in eslint.config.mjs blocks new top-level methods on
AppDatabase so the pass-through layer cannot silently grow back.
`AppDatabase.ts` dropped from 193 lines to 58; `AppDatabaseBase` lost
the 270-line trailing pass-through block.

tests/unit/resolve-workspace.test.ts

@@ -32,13 +32,13 @@ function seedCompany(db: AppDatabase) {
     description: "Regression fixture",
     status: "active",
   });
-  db.saveConnector({
+  db.connectorsCrud.saveConnector({
     id: "openai-codex",
     model: "gpt-5",
     envBindingText: "",
     notes: "fixture",
   });
-  const workspaceId = db.saveWorkspace({
+  const workspaceId = db.workspacesMod.saveWorkspace({
     companyId,
     name: "Default",
     localPath: "/tmp/fixture",
@@ -91,13 +91,13 @@ describe("resolveWorkspaceWithLockMode", () => {
 
   it("project-bound workspace → exclusive (single writer per repo)", () => {
     const { companyId } = seedCompany(db);
-    const projectId = db.saveProject({
+    const projectId = db.entityCrud.saveProject({
       companyId,
       name: "Platform",
       description: "",
       status: "active",
     });
-    db.saveWorkspace({
+    db.workspacesMod.saveWorkspace({
       companyId,
       name: "Project repo",
       localPath: "/tmp/project-ws",
@@ -131,7 +131,7 @@ describe("resolveWorkspaceWithLockMode", () => {
 
   it("task workspace wins over agent workspace even when both are set", () => {
     const { companyId, workspaceId: agentWsId } = seedCompany(db);
-    const taskWsId = db.saveWorkspace({
+    const taskWsId = db.workspacesMod.saveWorkspace({
       companyId,
       name: "Task-only",
       localPath: "/tmp/task-ws",