refactor: replace raw SQL with repository interfaces in entranceserver and API server

Extract all direct database calls from entranceserver (2 calls) and
API server (17 calls) into typed repository interfaces with PostgreSQL
implementations, matching the pattern established in signserver and
channelserver.

Entranceserver: EntranceServerRepo, EntranceSessionRepo
API server: APIUserRepo, APICharacterRepo, APISessionRepo

Also fix the 3 remaining fmt.Sprintf calls inside logger invocations
in handlers_commands.go and handlers_stage.go, replacing them with
structured zap fields.

Unskip 5 TestNewAuthData* tests that previously required a real
database — they now run with mock repos.

server/api/repo_session.go

@@ -0,0 +1,29 @@
+package api
+
+import (
+	"context"
+
+	"github.com/jmoiron/sqlx"
+)
+
+// APISessionRepository implements APISessionRepo with PostgreSQL.
+type APISessionRepository struct {
+	db *sqlx.DB
+}
+
+// NewAPISessionRepository creates a new APISessionRepository.
+func NewAPISessionRepository(db *sqlx.DB) *APISessionRepository {
+	return &APISessionRepository{db: db}
+}
+
+func (r *APISessionRepository) CreateToken(ctx context.Context, uid uint32, token string) (uint32, error) {
+	var tid uint32
+	err := r.db.QueryRowContext(ctx, "INSERT INTO sign_sessions (user_id, token) VALUES ($1, $2) RETURNING id", uid, token).Scan(&tid)
+	return tid, err
+}
+
+func (r *APISessionRepository) GetUserIDByToken(ctx context.Context, token string) (uint32, error) {
+	var userID uint32
+	err := r.db.QueryRowContext(ctx, "SELECT user_id FROM sign_sessions WHERE token = $1", token).Scan(&userID)
+	return userID, err
+}