apr(completion): persist completion and repo-binding records (#7664, #9490)

[JSONbored]

Problem

Both trusted lookups fail closed because no record exists to read. apr-repo-binding.ts
documents the risk precisely: without a server-side binding, installationId,
repoFullName and newOwner are all caller-supplied, so any authorized caller could act
on another customer's repo the moment completion starts returning true.

Scope

• Persist the APR repo binding: which customer login and installation an APR repo belongs
  to, written at creation time (not derivable later from caller input)
• Persist the completion record produced by the evaluation (sibling), keyed so
  loadAprIdeaCompletion can resolve it by repo and idea id
• Replace both stub bodies with real lookups, keeping signatures
• Tests must cover the failure direction explicitly: a binding for a different customer
  must not authorize, and a missing record must still fail closed rather than default open

Acceptance

Both lookups resolve real persisted records; the unauthorized-access path documented in
apr-repo-binding.ts is covered by a test that fails if the check is removed.

Ordering

This must land with or before the evaluation, never after — completion returning true
against an unbound repo is the exact primitive the fail-closed design exists to prevent.

[linear-code]

JSO-7082