fix(db): bound health scans and gate repairs on backup

[Bl0ck154]

Stacked on PR #13 (integrate/upstream-db-migrations). Production is not changed by this draft PR.

This extracts only the DB-health resource-bounds portion of upstream diegosouzapw#13717. It intentionally does NOT pull the child-process health runner, worker, feature flag, i18n/provider/build-wave changes, or unrelated release-tip changes.

Included

• page quota_snapshots in bounded batches of 1000 instead of loading the full history
• preserve SQLite int64 IDs as string cursors
• stop each scan at the initial upper ID so rows appended during the scan wait for the next health check
• reuse a prepared provider-connection lookup instead of preparing per row
• require a successful backup before the first repair mutation when a backup callback is provided
• apply that same backup-before-write guarantee to combo, quota, domain and schema repairs
• startup auto-repair catches a backup-gated health-check failure, logs it, and keeps serving the unchanged DB instead of aborting OmniRoute startup

Validation

• 36/36 focused DB-health tests pass
• resource-bounds suite covers pagination, prepare-count independence, append-during-scan, int64 cursor bounds and backup false/throw behavior
• npm run typecheck:core: pass
• npm run check:db-rules: pass
• eslint on changed core/health/tests: pass
• git diff --check: pass