Codemod db pass-through calls: messages + runs + approvals + company (C1 part 2/3)

Rewrite ~376 call sites for messages, runs, approvalsMod, and company
domains and delete the corresponding pass-through methods on
AppDatabase / AppDatabaseBase. Structural type references
(ReturnType<HandlerDeps["db"]["getRun"]>) and SweepStaleReviewsDeps-style
mocks are updated to route through the owning sub-module.

src/main/api-server/server-core.ts

@@ -217,7 +217,7 @@ export class AgentApiServer {
     if (typeof claimedRunId !== "string" || claimedRunId.trim() !== token.runId) {
       return { ok: false, status: 401, error: "Missing or mismatched X-Agent-Company-Run-Id header" };
     }
-    const runState = this._db.getRunAuthState(token.runId);
+    const runState = this._db.runs.getRunAuthState(token.runId);
     if (!runState || runState.companyId !== token.companyId || runState.agentId !== token.agentId) {
       return { ok: false, status: 403, error: "Token references an unknown or mismatched run" };
     }