Converge npm/Maven datastore stores onto OCI's explicit qrm.DB provider-closure (ADR-023)

Context

Raised in review of !826 (merged) (npm-hosted Step 26 wiring plan amendment): !826 (comment 3530863228)

The handler-seam dimension of cross-format wiring consistency is being handled directly in !826 (merged): npm's Step 26 plan now mirrors OCI's NewDispatchHandlerWith* constructor chain (previously Maven's Deps struct).

This issue tracks the remaining, larger dimension — datastore store construction. OCI's datastore methods take an explicit qrm.DB per ADR-023, and wire_oci.go wraps stores in adapters holding a db func() qrm.DB provider closure. npm and Maven diverge: their stores are already merged taking *postgres.Client directly and resolving client.DB() lazily per query.

Scope

• Audit the npm (internal/datastore/npm_*.go, ~11 stores) and Maven datastore stores against OCI's explicit-qrm.DB + provider-closure convention (ADR-023).
• Either converge npm/Maven onto that shape (store-signature + call-site refactor across already-merged code), or explicitly ratify the divergence with documented rationale.
• This is a cross-cutting refactor of merged datastore code, not a wiring-step change.

Related to !826 (merged).