refactor: move transaction management from services to API endpoints

- Services now use db.flush() instead of db.commit() for database operations
- API endpoints handle transaction commit after service calls
- Remove db.rollback() from services (let exception handlers manage this)
- Ensures consistent transaction boundaries at API layer

This pattern gives API endpoints full control over when to commit,
allowing for better error handling and potential multi-operation transactions.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/api/v1/shop/auth.py

@@ -83,6 +83,7 @@ def register_customer(
     customer = customer_service.register_customer(
         db=db, vendor_id=vendor.id, customer_data=customer_data
     )
+    db.commit()
 
     logger.info(
         f"New customer registered: {customer.email} for vendor {vendor.subdomain}",

app/api/v1/shop/cart.py

@@ -112,6 +112,7 @@ def add_to_cart(
         product_id=cart_data.product_id,
         quantity=cart_data.quantity,
     )
+    db.commit()
 
     logger.info(
         f"[SHOP_API] add_to_cart result: {result}",
@@ -165,6 +166,7 @@ def update_cart_item(
         product_id=product_id,
         quantity=cart_data.quantity,
     )
+    db.commit()
 
     return CartOperationResponse(**result)
 
@@ -201,6 +203,7 @@ def remove_from_cart(
     result = cart_service.remove_from_cart(
         db=db, vendor_id=vendor.id, session_id=session_id, product_id=product_id
     )
+    db.commit()
 
     return CartOperationResponse(**result)
 
@@ -230,5 +233,6 @@ def clear_cart(
     )
 
     result = cart_service.clear_cart(db=db, vendor_id=vendor.id, session_id=session_id)
+    db.commit()
 
     return ClearCartResponse(**result)

app/api/v1/shop/orders.py

@@ -68,6 +68,7 @@ def place_order(
     order = order_service.create_order(
         db=db, vendor_id=vendor.id, order_data=order_data
     )
+    db.commit()
 
     logger.info(
         f"Order {order.order_number} placed for vendor {vendor.subdomain}, "