refactor(server): move the dashboard, limits and log-forwarding handlers' SQL into repositories

[fylorn]

Part of moving the server handlers' raw SQL into repositories under crates/server/src/services/ (same approach as #45). No behaviour change.

What moved

All 40 Postgres sqlx::query* calls in these handlers now live in five repositories:

Repository	Handlers
observability_repository	dashboard/stats.rs (6), dashboard/live.rs (4), dashboard/scope.rs (2), dashboard/layout.rs (2), health.rs (3), route_observability.rs (1)
analytics_repository	analytics.rs (4), chargeback.rs (1), gateway_logs.rs (1), limits.rs (1)
log_forwarder_repository	log_forwarders.rs (8)
webhook_outbox_repository	webhook_outbox.rs (5)
limits_repository	limits_bulk.rs (2, the per-row lookup and mutation on rate_limit_rules / budget_caps)

• SQL text, binds and fetch kinds are carried over verbatim (checked by extracting every SQL literal before and after: the only differences are six statements that were written out twice, now one function each: the team-member id list in stats, the provider count shared by readiness and the stats tile, SELECT 1, the log-forwarder lookup, the cost-center lookup, and the API-key lineage lookup).
• Where a handler words the database error itself (dashboard scope and live snapshot, gateway-log lineage lookup, the bulk limits outcomes, the best-effort health probes), the repository returns the raw sqlx::Error so the message is unchanged. Everything else returns AppError exactly as ? did before.
• WebhookOutboxRow (a FromRow type) moves into webhook_outbox_repository; the route-health row type moves into observability_repository.
• ClickHouse queries are untouched.
• Handlers keep permission checks, validation, audit logging and response shaping.

Evidence of no behaviour change

New crates/test-support/tests/admin_observability.rs (9 tests) covers what the suite did not reach before: dashboard stats (PG fallback and the team-scoped ClickHouse path), live snapshot (provider/MCP rows, rpm reference line), layout save/replace, /health/ready and /api/health, route health ordering, API-key limits stored on the key lineage, log forwarder CRUD / toggle / reset-stats / test, webhook outbox list / counts / delete / retry, and analytics cost breakdowns by user and cost center with team scoping.

• The new tests pass against the original code (git stash of crates/server) and against this change.

Checks run locally

• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings and cargo clippy --workspace --lib -- -D warnings
• cargo nextest run --workspace --lib --bins --tests: 687 passed
• Full integration suite (--run-ignored only --profile ci) with local pg/redis/clickhouse: 292 passed
• After rebasing onto refactor(server): move the catalog's SQL into repositories #45: fmt, both clippy runs, and the admin_observability, admin_catalog and openapi_contract binaries again

🤖 Generated with Claude Code