refactor(repository): 收敛 model/repository 分层为唯一持久化入口

将 OpenFlare 与平台业务的数据访问从 model 与 apps 直连迁入 repository，
model 仅保留实体与无 IO 规则；补充 code-check 架构守卫与开发规范。

internal/apps/openflare/proxy_route/build_helpers.go

@@ -11,7 +11,6 @@ import (
 	"strings"
 
 	"github.com/Rain-kl/Wavelet/internal/model"
-	"gorm.io/gorm"
 )
 
 type proxyRouteJSONFields struct {
@@ -141,38 +140,3 @@ func applyProxyRouteUpstreamType(ctx context.Context, route *model.ProxyRoute, u
 	}
 	return nil
 }
-
-func updateProxyRouteRecord(tx *gorm.DB, route *model.ProxyRoute) error {
-	return tx.Model(&model.ProxyRoute{}).Where("id = ?", route.ID).Updates(map[string]any{
-		"site_name": route.SiteName, "origin_id": route.OriginID, "origin_url": route.OriginURL,
-		"origin_host": route.OriginHost, "upstreams": route.Upstreams, "enabled": route.Enabled,
-		"enable_https": route.EnableHTTPS, "redirect_http": route.RedirectHTTP,
-		"limit_conn_per_server": route.LimitConnPerServer, "limit_conn_per_ip": route.LimitConnPerIP,
-		"limit_rate": route.LimitRate, "cache_enabled": route.CacheEnabled, "cache_policy": route.CachePolicy,
-		"cache_rules": route.CacheRules, "custom_headers": route.CustomHeaders,
-		"basic_auth_enabled": route.BasicAuthEnabled, "basic_auth_username": route.BasicAuthUsername,
-		"basic_auth_password": route.BasicAuthPassword,
-		"upstream_type":       route.UpstreamType, "tunnel_node_id": route.TunnelNodeID,
-		"tunnel_target_addr": route.TunnelTargetAddr, "tunnel_target_protocol": route.TunnelTargetProtocol,
-		"pages_project_id": route.PagesProjectID,
-	}).Error
-}
-
-func replaceZoneDomainRouteBindings(tx *gorm.DB, routeID uint, domainIDs []uint) error {
-	var requested []model.ZoneDomain
-	if err := tx.Where("id IN ?", domainIDs).Find(&requested).Error; err != nil {
-		return err
-	}
-	if len(requested) != len(domainIDs) {
-		return errors.New(errProxyRouteZoneDomainNotFound)
-	}
-	for _, domain := range requested {
-		if domain.ProxyRouteID != nil && *domain.ProxyRouteID != routeID {
-			return errors.New(errProxyRouteZoneDomainBound)
-		}
-	}
-	if err := tx.Model(&model.ZoneDomain{}).Where("proxy_route_id = ? AND id NOT IN ?", routeID, domainIDs).Update("proxy_route_id", nil).Error; err != nil {
-		return err
-	}
-	return tx.Model(&model.ZoneDomain{}).Where("id IN ?", domainIDs).Update("proxy_route_id", routeID).Error
-}