feat(api): add analytics-scoped public API and clean up analytics data access (#1119)

* feat(api): add analytics-scoped public API and clean up analytics data access

Publishes all 30 internal analytics procedures under a new `analytics`
token scope at /v1/analytics/*, closing the gap where analytics tokens
could only reach error logs. Since apps/mcp-server derives its tool
list from /public-spec.json, this also exposes the endpoints as MCP
tools with no MCP-side work.

Also moves inline db.* queries out of packages/analytics services and
into their matching repositories, fixing the same layering violation
the broader data-access cleanup targets, in the domain this PR already
touches.

* fix(analytics): scope broadcast stats to workspace and close analytics public-API review gaps

The new analytics public API (#1119) made broadcastStats reachable by
API token for the first time, exposing a pre-existing IDOR:
getBatchStats/getContacts never filtered on workspaceId, so a
workspace-A token could read workspace-B's broadcast delivery/seen/
click/failure counts and contact lists via a guessable broadcastId.
Both now join Broadcast and scope on workspaceId.

resetStatsSession had a related but lower-severity issue: it inserted
a FlowAnalyticsSession row for any flowId without verifying it belongs
to the caller's workspace, letting a foreign flowId write an orphan
row into the caller's workspace on every call. It now no-ops when the
flow isn't found in-scope.

Also addresses the rest of the PR #1119 review:
- extend the public-spec workspaceId leak guard to request schemas
  (parameters + body), not just responses
- replace withPublicPaging's `as never` cast with shape destructuring
  so a schema missing page/perPage fails at compile time instead of
  crashing every public route at module load
- de-duplicate findContactInboxesWithContact into BaseRepository
- reuse existing @chatbotx.io/analytics/schemas response schemas
  instead of hand-copying four of them in schema/public.ts
- finish the db.* cleanup: add LinkStatsRepository.insertStats() and
  move magic-link/ref-link click inserts off direct db.insert
- swap sql.raw for sql.identifier in sequence-stats.repository.ts
- tighten the refLinkContacts PII test to the full allow-list form

* chore: change contact update method to contact repository

* chore: fix public-spec test

Author: realcodesiman

apps/builder/__tests__/__snapshots__/public-spec-operations.test.ts.snap

@@ -57,6 +57,156 @@ exports[`public API spec — operation naming guard > operation list (operationI
     "operationId": "aiTriggers.update",
     "path": "/v1/ai-triggers/{id}",
   },
+  {
+    "method": "GET",
+    "operationId": "analytics.activeContactsCount",
+    "path": "/v1/analytics/active-contacts-count",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.blockedContactsCount",
+    "path": "/v1/analytics/blocked-contacts-count",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.blockedContactsPerDay",
+    "path": "/v1/analytics/blocked-contacts-per-day",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.botMessagesAiProviders",
+    "path": "/v1/analytics/bot-messages-ai-providers",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.botMessagesByResult",
+    "path": "/v1/analytics/bot-messages-by-result",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.botMessagesNoResponse",
+    "path": "/v1/analytics/bot-messages-no-response",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.botMessagesWithResponse",
+    "path": "/v1/analytics/bot-messages-with-response",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.broadcastStats",
+    "path": "/v1/analytics/broadcasts/{broadcastId}/stats",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.contactCountsPerDay",
+    "path": "/v1/analytics/contact-counts-per-day",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.contactsByDimension",
+    "path": "/v1/analytics/contacts-by-dimension",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.contactsCount",
+    "path": "/v1/analytics/contacts-count",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.conversationArchived",
+    "path": "/v1/analytics/conversation-archived",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.conversationAssigned",
+    "path": "/v1/analytics/conversation-assigned",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.conversationAssignedByAdmin",
+    "path": "/v1/analytics/conversation-assigned-by-admin",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.conversationFollowUps",
+    "path": "/v1/analytics/conversation-followups",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.conversationHandoffs",
+    "path": "/v1/analytics/conversation-handoffs",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.flowStats",
+    "path": "/v1/analytics/flows/{flowId}",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.humanAgentStats",
+    "path": "/v1/analytics/human-agent-stats",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.macActiveContactCount",
+    "path": "/v1/analytics/mac/active-count",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.magicLinkContacts",
+    "path": "/v1/analytics/magic-links/contacts",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.magicLinkStats",
+    "path": "/v1/analytics/magic-links/stats",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.messagesByAdmin",
+    "path": "/v1/analytics/messages-by-admin",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.messagesBySender",
+    "path": "/v1/analytics/messages-by-sender",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.newContactCountsPerDay",
+    "path": "/v1/analytics/new-contact-counts-per-day",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.newContactsCount",
+    "path": "/v1/analytics/new-contacts-count",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.refLinkContacts",
+    "path": "/v1/analytics/ref-links/contacts",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.refLinkStats",
+    "path": "/v1/analytics/ref-links/stats",
+  },
+  {
+    "method": "DELETE",
+    "operationId": "analytics.resetFlowStats",
+    "path": "/v1/analytics/flows/{flowId}",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.sequenceStepStats",
+    "path": "/v1/analytics/sequences/{sequenceId}/steps/{stepId}/stats",
+  },
+  {
+    "method": "GET",
+    "operationId": "analytics.uniqueConversationsByAdmin",
+    "path": "/v1/analytics/unique-conversations-by-admin",
+  },
   {
     "method": "PUT",
     "operationId": "botFields.bulkUpdate",