ci: coverage/db-integration gates, dep boundaries, and workspace-scoping ratchet

[realcodesiman]

Implements P0/P1/P2 items C1, C2, C3, C8, C5 (partial), B14 (partial safety net) from the system-design-review audit.

C1 — coverage gate in CI

Coverage was defined (80% threshold in the shared vitest preset) but CI never ran --coverage. Added a starter-scope coverage job (packages/business + worker) rather than the full 56-suite matrix, to keep CI wall-clock reasonable.

C2 — real Postgres/Redis integration tests in CI

packages/database/__tests__/integration/* all describe.skipIf(!databaseUrl) and never ran in CI. Added a database-integration job with real postgres/redis services (matching docker-compose.yml's image/credentials), migrating from zero then running test:db.

C3 — dependency-cruiser no-direct-db rule

Added a no-direct-db-import rule forbidding apps/(builder|worker) and integrations/* from importing @chatbotx.io/database/client directly, plus wired check:circular (madge) and check:unused (knip) into CI.

C8 — zod dedupe

Root package.json already pinned zod@^4.3.6 via overrides; pnpm dedupe cleaned up a remaining duplicate resolution and pnpm dedupe --check was added to CI so it can't silently regress.

C5 — complexity lint rules at warn (partial)

Flipped noExcessiveLinesPerFunction/noExcessiveCognitiveComplexity from off to warn (not error — confirmed locally that warnings don't fail ultracite check's exit code). Surfaces 2310 warnings; not attempting to fix any of them here — that's the separate, larger god-file-splitting initiative the audit scoped as its own quarterly item.

B14 — workspace-scoping safety net (partial)

Implemented the code-only safety net the audit proposed as an interim mitigation, explicitly not Postgres RLS (that needs its own staged rollout):

• scripts/check-workspace-scoping.mjs: a TypeScript-AST scan of packages/database/src/repositories/**/*.ts for functions that take a workspaceId param but never reference it in a query-shaped body. Ratchets via check-workspace-scoping.allowlist.json — only fails CI on new violations. Found and allowlisted 2 real (verified false-positive) hits in ads-conversion-rule/repository.ts, where the filter is built through a shared workspaceRuleFilter helper the textual scan can't see through — documented with a comment at the helper.
• packages/database/__tests__/integration/workspace-isolation.test.ts: seeds two real workspaces' Contact/Conversation/Message rows and asserts a workspace-A-scoped read never returns workspace B's row, using the real repositories.

Verification

• pnpm --filter @chatbotx.io/database check-types && test:db against real local Postgres — 19/19 integration tests pass (including the new isolation test)
• node scripts/check-workspace-scoping.mjs passes cleanly against the seeded baseline; smoke-tested that it does catch a deliberately-injected violation
• pnpm why zod / pnpm dedupe --check verified clean