[T4-3] Lint gate: actor first, raw queries only in repositories

[liangricky7]

Blocked by: T4-2 (#21) · Blocks: —

(Was sprint 1 ticket 9.) Seam S2 is meant to be enforced by a lint rule, and that rule doesn't exist yet. Writing it now, while there are only a handful of call sites, is far cheaper than retrofitting it later.

• Fails any exported repository method whose first parameter is not the actor
• Fails any raw Drizzle query outside a repository file
• Runs in CI and fails the build
• Ships with an example file that must fail and one that must pass

Stretch: the same check for "no whole-document writes" (seam S4). Skip it if it fights you.

Needs approval: ESLint and typescript-eslint.

---

Source: docs/backend-tickets.md