refactor(repository): 收敛 model/repository 分层为唯一持久化入口

将 OpenFlare 与平台业务的数据访问从 model 与 apps 直连迁入 repository，
model 仅保留实体与无 IO 规则；补充 code-check 架构守卫与开发规范。

internal/repository/openflare_waf_bindings_test.go

@@ -0,0 +1,56 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package repository
+
+import (
+	"context"
+	"testing"
+
+	"github.com/Rain-kl/Wavelet/internal/model"
+
+	db "github.com/Rain-kl/Wavelet/internal/infra/persistence"
+	"github.com/glebarez/sqlite"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+)
+
+func setupWAFBindingsTestDB(t *testing.T) func() {
+	t.Helper()
+
+	sqliteDB, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{
+		DisableForeignKeyConstraintWhenMigrating: true,
+	})
+	require.NoError(t, err)
+	require.NoError(t, sqliteDB.AutoMigrate(&model.OpenFlareWAFRuleGroupBinding{}))
+
+	db.SetDB(sqliteDB)
+	return func() {
+		db.SetDB(nil)
+	}
+}
+
+func TestReplaceOpenFlareWAFRuleGroupBindingsAfterExplicitHighID(t *testing.T) {
+	cleanup := setupWAFBindingsTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	conn := db.DB(ctx)
+	require.NotNil(t, conn)
+	require.NoError(t, conn.Create(&model.OpenFlareWAFRuleGroupBinding{
+		ID:           50,
+		RuleGroupID:  1,
+		ProxyRouteID: 1,
+	}).Error)
+
+	require.NoError(t, ReplaceOpenFlareWAFRuleGroupBindings(ctx, 2, []uint{2, 3}))
+
+	var bindings []model.OpenFlareWAFRuleGroupBinding
+	require.NoError(t, conn.Where("rule_group_id = ?", 2).Order("proxy_route_id asc").Find(&bindings).Error)
+	require.Len(t, bindings, 2)
+	assert.Equal(t, uint(2), bindings[0].ProxyRouteID)
+	assert.Equal(t, uint(3), bindings[1].ProxyRouteID)
+	assert.Greater(t, bindings[0].ID, uint(50))
+	assert.Greater(t, bindings[1].ID, bindings[0].ID)
+}