refactor: migrate remaining raw select() calls to repository pattern (292 violations)

[KonstantinMirin]

Summary

PR #1097 introduced the repository/Unit of Work pattern and a structural guard (test_architecture_no_raw_select.py) that prevents new raw select() calls outside repositories. 292 pre-existing violations are allowlisted.

This issue tracks the remediation of those violations — migrating all raw select() calls to go through repository classes.

Violations by layer

Layer	Count	Files
Admin blueprints	133	creatives, workflows, products, principals, settings, etc.
Services	65	background services, GAM inventory, order approval, etc.
Core	34	config_loader, context_manager, auth, strategy, etc.
Adapters	24	GAM managers, reporting, mock adapter
Admin utilities	26	domain_access, sync_api, tenant_management, helpers
Routes	2	health debug endpoints

Approach

• Work layer by layer, starting with the smallest (routes, admin utilities)
• For each file: create/extend a repository class, move queries into typed methods, update callers
• Remove allowlist entries as violations are fixed (the stale-entry test enforces this)
• The allowlist can only shrink — new violations fail the build immediately

Acceptance criteria

• ALLOWLIST in test_architecture_no_raw_select.py is empty
• make quality passes
• ./run_all_tests.sh passes — full suite, 0 failures

Context

• Guard: tests/unit/test_architecture_no_raw_select.py
• Architecture pattern: CLAUDE.md Pattern feat: Adapter configuration UI, product management improvements, and UI/UX fixes #3 (Repository Pattern)
• Origin: PR refactor: Eliminate get_db_session() from business logic — complete repository pattern adoption #1097 review by @ChrisHuie