docs(server): name the query API per statement shape and hold QueryBuilder calls to a baseline

server/CLAUDE.md now says which API new repository code uses: Kysely for join, aggregate and set-based statements, the entity methods for single-table CRUD, no new QueryBuilder calls. The TrekRepository docstring no longer calls Kysely an escape hatch. lint:query-api counts this.qb()/createQueryBuilder() per repository file against a baseline that may only shrink and runs in the server CI job.

The same file documents the JSON column and timestamp rules from the two changes before.

.github/workflows/test.yml

@@ -311,6 +311,12 @@ jobs:
         # through tests/helpers/factories (MikroORM) instead.
         run: cd server && npm run lint:test-sql
 
+      - name: QueryBuilder calls in the repositories may only shrink
+        # Counts this.qb(...)/createQueryBuilder(...) per file under
+        # src/db/repositories/ against scripts/query-api-baseline.json. New
+        # code uses Kysely for join reads and the entity methods for CRUD.
+        run: cd server && npm run lint:query-api
+
       - name: Open request schemas may only shrink
         # Needs the shared build above. Counts open shapes (records of
         # unknown, passthrough, any) in shared's request schemas.