refactor(db): route remaining raw DB access through repositories

proxmox, session-log, oidc-utils, webauthn and guacamole recording now use
repositories (new WebauthnCredentialRepository; SsoProviderRepository
listEnabled; HostRepository findDecryptedByIdAs/listProxmoxEnabled).
Remaining raw access: db boot code, simple-db-ops and docker.ts, which are
removed/restructured in later phases.

src/backend/database/repositories/factory.ts

@@ -1,6 +1,7 @@
 import { DatabaseSaveTrigger } from "../../utils/database-save-trigger.js";
 import { getDb, getSqlite } from "../db/index.js";
 import type { DatabaseContext } from "./database-context.js";
+import { WebauthnCredentialRepository } from "./webauthn-credential-repository.js";
 import { AlertRepository } from "./alert-repository.js";
 import { ApiKeyRepository } from "./api-key-repository.js";
 import { AuditLogRepository } from "./audit-log-repository.js";
@@ -68,6 +69,13 @@ export function getCurrentSettingValue(key: string): string | null {
   return row?.value ?? null;
 }
 
+export function createCurrentWebauthnCredentialRepository(): WebauthnCredentialRepository {
+  return new WebauthnCredentialRepository(
+    createCurrentRepositoryContext(),
+    createCurrentRepositoryWriteHook("webauthn_credential_repository_write"),
+  );
+}
+
 export function createCurrentAlertRepository(): AlertRepository {
   return new AlertRepository(
     createCurrentRepositoryContext(),