refactor: move transaction management from services to API endpoints

- Services now use db.flush() instead of db.commit() for database operations
- API endpoints handle transaction commit after service calls
- Remove db.rollback() from services (let exception handlers manage this)
- Ensures consistent transaction boundaries at API layer

This pattern gives API endpoints full control over when to commit,
allowing for better error handling and potential multi-operation transactions.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/services/admin_service.py

@@ -82,7 +82,7 @@ class AdminService:
             original_status = user.is_active
             user.is_active = not user.is_active
             user.updated_at = datetime.now(UTC)
-            db.commit()
+            db.flush()
             db.refresh(user)
 
             status_action = "activated" if user.is_active else "deactivated"
@@ -92,7 +92,6 @@ class AdminService:
             return user, message
 
         except Exception as e:
-            db.rollback()
             logger.error(f"Failed to toggle user {user_id} status: {str(e)}")
             raise UserStatusChangeException(
                 user_id=user_id,
@@ -185,7 +184,7 @@ class AdminService:
             is_active=True,
         )
         db.add(user)
-        db.commit()
+        db.flush()
         db.refresh(user)
 
         logger.info(f"Admin {current_admin_id} created user {user.username}")
@@ -266,7 +265,7 @@ class AdminService:
             user.is_active = is_active
 
         user.updated_at = datetime.now(UTC)
-        db.commit()
+        db.flush()
         db.refresh(user)
 
         logger.info(f"Admin {current_admin_id} updated user {user.username}")
@@ -305,7 +304,6 @@ class AdminService:
 
         username = user.username
         db.delete(user)
-        db.commit()
 
         logger.info(f"Admin {current_admin_id} deleted user {username}")
         return f"User {username} deleted successfully"
@@ -405,7 +403,7 @@ class AdminService:
             # Create default roles for vendor
             self._create_default_roles(db, vendor.id)
 
-            db.commit()
+            db.flush()
             db.refresh(vendor)
 
             logger.info(
@@ -415,10 +413,8 @@ class AdminService:
             return vendor
 
         except (VendorAlreadyExistsException, ValidationException):
-            db.rollback()
             raise
         except Exception as e:
-            db.rollback()
             logger.error(f"Failed to create vendor: {str(e)}")
             raise AdminOperationException(
                 operation="create_vendor",
@@ -499,7 +495,7 @@ class AdminService:
             if vendor.is_verified:
                 vendor.verified_at = datetime.now(UTC)
 
-            db.commit()
+            db.flush()
             db.refresh(vendor)
 
             status_action = "verified" if vendor.is_verified else "unverified"
@@ -509,7 +505,6 @@ class AdminService:
             return vendor, message
 
         except Exception as e:
-            db.rollback()
             logger.error(f"Failed to verify vendor {vendor_id}: {str(e)}")
             raise VendorVerificationException(
                 vendor_id=vendor_id,
@@ -525,7 +520,7 @@ class AdminService:
             original_status = vendor.is_active
             vendor.is_active = not vendor.is_active
             vendor.updated_at = datetime.now(UTC)
-            db.commit()
+            db.flush()
             db.refresh(vendor)
 
             status_action = "activated" if vendor.is_active else "deactivated"
@@ -535,7 +530,6 @@ class AdminService:
             return vendor, message
 
         except Exception as e:
-            db.rollback()
             logger.error(f"Failed to toggle vendor {vendor_id} status: {str(e)}")
             raise AdminOperationException(
                 operation="toggle_vendor_status",
@@ -560,13 +554,11 @@ class AdminService:
             # - Delete import jobs
 
             db.delete(vendor)
-            db.commit()
 
             logger.warning(f"Vendor {vendor_code} and all associated data deleted")
             return f"Vendor {vendor_code} successfully deleted"
 
         except Exception as e:
-            db.rollback()
             logger.error(f"Failed to delete vendor {vendor_id}: {str(e)}")
             raise AdminOperationException(
                 operation="delete_vendor", reason="Database deletion failed"
@@ -650,7 +642,7 @@ class AdminService:
 
             vendor.updated_at = datetime.now(UTC)
 
-            db.commit()
+            db.flush()
             db.refresh(vendor)
 
             logger.info(
@@ -660,10 +652,8 @@ class AdminService:
             return vendor
 
         except ValidationException:
-            db.rollback()
             raise
         except Exception as e:
-            db.rollback()
             logger.error(f"Failed to update vendor {vendor_id}: {str(e)}")
             raise AdminOperationException(
                 operation="update_vendor", reason=f"Database update failed: {str(e)}"