refactor: move transaction management from services to API endpoints

- Services now use db.flush() instead of db.commit() for database operations
- API endpoints handle transaction commit after service calls
- Remove db.rollback() from services (let exception handlers manage this)
- Ensures consistent transaction boundaries at API layer

This pattern gives API endpoints full control over when to commit,
allowing for better error handling and potential multi-operation transactions.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/services/order_service.py

@@ -227,7 +227,7 @@ class OrderService:
                 order_item = OrderItem(order_id=order.id, **item_data)
                 db.add(order_item)
 
-            db.commit()
+            db.flush()
             db.refresh(order)
 
             logger.info(
@@ -242,10 +242,8 @@ class OrderService:
             InsufficientInventoryException,
             CustomerNotFoundException,
         ):
-            db.rollback()
             raise
         except Exception as e:
-            db.rollback()
             logger.error(f"Error creating order: {str(e)}")
             raise ValidationException(f"Failed to create order: {str(e)}")
 
@@ -354,7 +352,7 @@ class OrderService:
                 order.internal_notes = order_update.internal_notes
 
             order.updated_at = datetime.now(UTC)
-            db.commit()
+            db.flush()
             db.refresh(order)
 
             logger.info(f"Order {order.order_number} updated: status={order.status}")
@@ -362,10 +360,8 @@ class OrderService:
             return order
 
         except OrderNotFoundException:
-            db.rollback()
             raise
         except Exception as e:
-            db.rollback()
             logger.error(f"Error updating order: {str(e)}")
             raise ValidationException(f"Failed to update order: {str(e)}")