Extract @codra/db behind a repository interface

[devarshishimpi]

Why

src/server/db is 18 modules of hand-written SQL that each take a Cloudflare binding and each open access to Postgres via src/server/db/client.ts. Callers in routes, services and core all reach into these modules directly, so SQL is effectively part of the engine's public surface, and the pooled-connection rules (session-scoped SET/advisory locks must be transaction-scoped) are enforced by convention in each module rather than in one place.

Scope

• Move src/server/db/* to packages/db/src, keeping the current module split (jobs lifecycle/leases/activity/mapping, file reviews, findings, repositories, repo configs, model configs, accounts, app settings, comment feedback, learning, stats, webhook deliveries).
• Define repository interfaces in packages/core/src/ports (one per domain area, e.g. JobsRepository, FindingsRepository, AccountsRepository) describing what the engine needs. packages/db implements them over Postgres in packages/db/src/repositories.
• Centralize connection acquisition, transaction scoping and the pooled-backend rules (SET LOCAL, pg_advisory_xact_lock) in one place inside packages/db/src/client.ts so individual queries cannot get it wrong.
• Move db/migrations and scripts/migrate.mjs (plus migrate-env.mjs, migrate-sql-split.mjs) into packages/db.
• Provide an in-memory implementation of the repository interfaces in packages/db/test/fakes, and use it to run the same contract test suite as the Postgres implementation.

Acceptance criteria

• No SQL string exists outside packages/db.
• packages/core and any code that used to import src/server/db directly now import the repository interfaces, never postgres.
• Migrations still run via the existing script and against the existing schema, no data migration in this issue.
• The in-memory implementation passes the same contract test suite as the Postgres one.
• test/review and test/findings can run against the in-memory repositories instead of a real database.