refactor: move transaction management from services to API endpoints

- Services now use db.flush() instead of db.commit() for database operations
- API endpoints handle transaction commit after service calls
- Remove db.rollback() from services (let exception handlers manage this)
- Ensures consistent transaction boundaries at API layer

This pattern gives API endpoints full control over when to commit,
allowing for better error handling and potential multi-operation transactions.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/services/cart_service.py

@@ -206,7 +206,7 @@ class CartService:
                 )
 
             existing_item.quantity = new_quantity
-            db.commit()
+            db.flush()
             db.refresh(existing_item)
 
             logger.info(
@@ -245,7 +245,7 @@ class CartService:
             price_at_add=current_price,
         )
         db.add(cart_item)
-        db.commit()
+        db.flush()
         db.refresh(cart_item)
 
         logger.info(
@@ -337,7 +337,7 @@ class CartService:
 
         # Update quantity
         cart_item.quantity = quantity
-        db.commit()
+        db.flush()
         db.refresh(cart_item)
 
         logger.info(
@@ -392,7 +392,6 @@ class CartService:
             )
 
         db.delete(cart_item)
-        db.commit()
 
         logger.info(
             "[CART_SERVICE] Removed item from cart",
@@ -426,8 +425,6 @@ class CartService:
             .delete()
         )
 
-        db.commit()
-
         logger.info(
             "[CART_SERVICE] Cleared cart",
             extra={