refactor(data-access): move tag logic onto the repository pattern

[realcodesiman]

Summary

• Introduces packages/database/src/repositories/tag (pure data access) and rewrites packages/business/src/tag/service.ts to call it instead of querying db directly, adding create/update/deleteMany methods that didn't exist before.
• Shrinks the contact-tag actions (add/remove/update-contact-tag.action.ts) by ~90% — the sync logic (attach, detach, diff-based update) moves into the service.
• Renames tags/api/token-auth.ts → workspace-token.ts onto the @chatbotx.io/api-contract/tag contract (from feat(api-contract): add @chatbotx.io/api-contract package and implement public routers from it #1069) now that tagService has the CRUD methods the contract-based handlers need.
• Adds apps/builder/src/lib/action-field-error.ts — a mapExceptionToFieldError helper bridging service-thrown ChatbotXException domain errors into next-safe-action field errors (i18n-translated; verified messages.nameAlreadyExists and fields.tag.label exist).

⚠️ Branch dependency

Stacked on #1065, #1066, #1068, #1069 — needs the @chatbotx.io/api-contract/tag contract from #1069.

This is the highest bug-risk section of the whole original migration branch — here's what I did about that

The plan flagged re-homing the 898-line deleted contact-tag-actions.test.ts as the top risk. Before touching any code:

• Compared every test name in the 3 deleted files (contact-tag-actions.test.ts, delete-tag-action.test.ts, tag-crud-actions.test.ts) against the 3 new files (packages/database/__tests__/tag-repository.test.ts, packages/business/src/tag/__tests__/{service,contact-tag-sync}.test.ts) one by one. Confirmed every scenario maps to an equivalent — some legitimately consolidated (three chunk-boundary tests at counts 200/201/400 became one test at the 200/201 boundary, since chunking moved from redundant action-level tests to one service-level test).
• invariant-guard caught two real gaps this comparison missed on a first pass: TagRepository.create/.update had zero dedicated tests, and the re-homed softDeleteMany test dropped the old workspace-scoping assertion entirely. Fixed by adding 4 new tests, including a collectBoundValues() helper that walks Drizzle's real and(eq(...)) SQL condition tree to verify workspace scoping against actual bound parameter values — not a mock's own shape.
• Net effect: builder lost 53 tests (the 3 deleted files), packages/business gained 43, packages/database gained 26 (22 original re-homed + 4 from the coverage-gap fix). Total test count across the three packages went up, not down.

A real regression found and fixed during review

The source branch's new tagService.attachToContact() silently dropped a contactInboxId?: string parameter that the old version threaded into emitTagApplied(workspaceId, contactId, tagId, contactInboxId) for ads/CAPI attribution. The event dispatcher (packages/events/src/event-dispatcher.ts) still accepts this 4th argument — it just wasn't being passed anymore. The only caller relying on it, packages/business/src/minigame/minigame-contact-service.ts (an unrelated file, untouched by this PR otherwise), failed to typecheck as a direct result — that's how this surfaced. Restored the parameter and its threading; invariant-guard cross-checked against origin/main to confirm no other call site historically needed the same treatment.

Also found while extracting (not in the original plan's file list)

apps/builder/src/features/contacts/api/private.ts (293 lines, full rewrite) — combines tag-related and custom-field-related contact endpoints. Verified every dependency it calls (tagService, tagRepository, plus the unrelated-but-pre-existing setContactCustomFieldValue/deleteContactCustomFields) was stable before including it. It no longer imports db directly (was: db.query.tagModel.findFirst at the old line 222 — now goes through tagRepository.findById).

Test plan

• pnpm lint — clean
• pnpm --filter builder check-types, pnpm --filter @chatbotx.io/business check-types, pnpm --filter @chatbotx.io/database check-types — all clean
• pnpm --filter builder test — 1976/1976 (down 53 from the 3 deleted/re-homed test files, as expected)
• pnpm --filter @chatbotx.io/business test — 1512/1512 (+43)
• pnpm --filter @chatbotx.io/database test — 552/552 (+26, includes the coverage-gap fix)
• pnpm check:circular — no new circular deps (69 pre-existing, unchanged)
• invariant-guard agent review — found 1 violation (test coverage gap), fixed and independently re-verified (helper confirmed to use real, non-mocked and/eq/isNull from drizzle-orm)
• Manual security review — findByContactId/listByContactId take no workspaceId param, but confirmed this is a pre-existing, unchanged design (identical signature on main), not something this PR introduces

[realcodesiman]

Closing for now — this PR was opened by an automated process without review. Reopening once PR-4 (which this stacks on) has its validation-regression fixes applied and the stack is properly reviewed.