refactor: replace raw SQL with repository interfaces in entranceserver and API server

Extract all direct database calls from entranceserver (2 calls) and
API server (17 calls) into typed repository interfaces with PostgreSQL
implementations, matching the pattern established in signserver and
channelserver.

Entranceserver: EntranceServerRepo, EntranceSessionRepo
API server: APIUserRepo, APICharacterRepo, APISessionRepo

Also fix the 3 remaining fmt.Sprintf calls inside logger invocations
in handlers_commands.go and handlers_stage.go, replacing them with
structured zap fields.

Unskip 5 TestNewAuthData* tests that previously required a real
database — they now run with mock repos.

server/channelserver/handlers_commands.go

@@ -32,9 +32,9 @@ func initCommands(cmds []cfg.Command, logger *zap.Logger) {
 		for _, cmd := range cmds {
 			commands[cmd.Name] = cmd
 			if cmd.Enabled {
-				logger.Info(fmt.Sprintf("Command %s: Enabled, prefix: %s", cmd.Name, cmd.Prefix))
+				logger.Info("Command registered", zap.String("name", cmd.Name), zap.String("prefix", cmd.Prefix), zap.Bool("enabled", true))
 			} else {
-				logger.Info(fmt.Sprintf("Command %s: Disabled", cmd.Name))
+				logger.Info("Command registered", zap.String("name", cmd.Name), zap.Bool("enabled", false))
 			}
 		}
 	})

server/channelserver/handlers_stage.go

@@ -1,7 +1,6 @@
 package channelserver
 
 import (
-	"fmt"
 	"strings"
 	"time"
 
@@ -90,7 +89,7 @@ func doStageTransfer(s *Session, ackHandle uint32, stageID string) {
 
 	if s.stage != nil { // avoids lock up when using bed for dream quests
 		// Notify the client to duplicate the existing objects.
-		s.logger.Info(fmt.Sprintf("Sending existing stage objects to %s", s.Name))
+		s.logger.Info("Sending existing stage objects", zap.String("session", s.Name))
 
 		// Lock stage to safely iterate over objects map
 		// We need to copy the objects list first to avoid holding the lock during packet building