refactor(repository): 收敛 model/repository 分层为唯一持久化入口

将 OpenFlare 与平台业务的数据访问从 model 与 apps 直连迁入 repository，
model 仅保留实体与无 IO 规则；补充 code-check 架构守卫与开发规范。

internal/apps/openflare/agent/ws_status.go

@@ -8,8 +8,9 @@ import (
 	"encoding/json"
 	"log/slog"
 
+	"github.com/Rain-kl/Wavelet/internal/repository"
+
 	ofws "github.com/Rain-kl/Wavelet/internal/apps/openflare/websocket"
-	"github.com/Rain-kl/Wavelet/internal/model"
 )
 
 // HandleWSStatus processes an agent websocket status payload (replaces HTTP heartbeat in WS mode).
@@ -20,7 +21,7 @@ func HandleWSStatus(ctx context.Context, nodeID, remoteAddr string, rawPayload j
 		return
 	}
 
-	authNode, err := model.GetOpenFlareNodeByNodeID(ctx, nodeID)
+	authNode, err := repository.GetOpenFlareNodeByNodeID(ctx, nodeID)
 	if err != nil {
 		slog.Debug("agent ws status reload node failed", "node_id", nodeID, "error", err)
 		return