refactor(builder): move flows, triggers, sequences, broadcasts, webhooks data access into business

[realcodesiman]

Summary

• Removes every direct db.* call from flows, triggers, sequences, broadcasts, webhooks, the template resource picker and saved replies in the builder, per .agents/rules/data-access.md. Public oRPC router keys, paths and summaries are untouched; public-spec-operations.test.ts.snap is byte-identical.
• One of seven parallel scope PRs following feat(contacts): cover full public API for MCP, move logic into business services #1093 (contacts); based on main, append-only barrel edits (./whatsapp-message-template is also added by the meta-channels PR refactor(builder): move messenger, instagram and whatsapp data access into business #1100; keep one).

Changes

• New repositories: flow, sequence (keeps the extras count closures inside for type inference), broadcast, trigger, condition, template-selectable-resource (13 category queries moved verbatim, including the keywords OR + arrayContains branch); webhook repository gains paginated list and detail reads.
• flowService.{createWithDefaultDraft,assertAllExist}, flowVersionService.publish (4-statement transaction, cache tag, audit), triggerService.{countByWorkspaceId,create,updateWithConditions,updateSettings}, webhookService.{countByWorkspaceId,createDraft,deleteMany,updateWithConditions,updateSettings} (trigger and webhook condition-diff semantics deliberately kept separate), new sequenceService, broadcastService.{create,resend}, savedReplyService.listByWorkspaceId.
• validationException added to packages/business/src/errors.ts in the same plain-factory/400 form as feat(contacts): cover full public API for MCP, move logic into business services #1093; actions map code === "validation" + field back to returnValidationErrors so inline form errors are unchanged.
• Tests re-pointed to the service/repository boundary; new business tests for publish, create-with-draft, condition diffs, sequence, broadcast create/resend and webhook methods; new list-selectable-resources.test.ts.

Behavior changes

• deleteSequence now also scopes the DELETE by workspaceId (defense in depth; ownership was already enforced by the preceding lookup).
• Trigger/webhook settings-update and sequence detail lookups throw notFoundException (404) instead of a bare Error (500).
• Pre-existing bugs preserved verbatim and listed as follow-ups in the plan: updateTriggerSettings does not refresh the trigger cache when active flips; updateWebhookAction lacks the SSRF assertPublicUrl guard that register has; getSequence calls a session-requiring helper yet serves the workspace-token public route.

Test plan

• pnpm --filter @chatbotx.io/database check-types && test
• pnpm --filter @chatbotx.io/business check-types && test (only the pre-existing ads-conversion-rule.service.test.ts failures remain, also red on main)
• pnpm --filter builder check-types && test (incl. public-spec-operations, snapshot unchanged)
• pnpm lint
• Manual: create/publish a flow; create/update a trigger and a webhook; create a sequence and a step; create/resend a broadcast (form field errors still inline); open the template picker tabs