refactor(repository): 收敛 model/repository 分层为唯一持久化入口

将 OpenFlare 与平台业务的数据访问从 model 与 apps 直连迁入 repository，
model 仅保留实体与无 IO 规则；补充 code-check 架构守卫与开发规范。

internal/apps/openflare/tasks/ssl_renew.go

@@ -7,8 +7,9 @@ import (
 	"context"
 	"time"
 
+	"github.com/Rain-kl/Wavelet/internal/repository"
+
 	"github.com/Rain-kl/Wavelet/internal/apps/openflare/tls"
-	"github.com/Rain-kl/Wavelet/internal/model"
 	"github.com/Rain-kl/Wavelet/pkg/logger"
 )
 
@@ -16,7 +17,7 @@ import (
 func RunSSLRenewJob(ctx context.Context) error {
 	logger.InfoF(ctx, "[OpenFlareTasks] SSL renew job started")
 
-	certificates, err := model.ListTLSCertificates(ctx)
+	certificates, err := repository.ListTLSCertificates(ctx)
 	if err != nil {
 		logger.ErrorF(ctx, "[OpenFlareTasks] list certificates failed: %v", err)
 		return err