refactor: move transaction management from services to API endpoints

- Services now use db.flush() instead of db.commit() for database operations
- API endpoints handle transaction commit after service calls
- Remove db.rollback() from services (let exception handlers manage this)
- Ensures consistent transaction boundaries at API layer

This pattern gives API endpoints full control over when to commit,
allowing for better error handling and potential multi-operation transactions.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/services/product_service.py

@@ -126,17 +126,15 @@ class ProductService:
             )
 
             db.add(product)
-            db.commit()
+            db.flush()
             db.refresh(product)
 
             logger.info(f"Added product {product.id} to vendor {vendor_id} catalog")
             return product
 
         except (ProductAlreadyExistsException, ValidationException):
-            db.rollback()
             raise
         except Exception as e:
-            db.rollback()
             logger.error(f"Error creating product: {str(e)}")
             raise ValidationException("Failed to create product")
 
@@ -168,17 +166,15 @@ class ProductService:
                 setattr(product, key, value)
 
             product.updated_at = datetime.now(UTC)
-            db.commit()
+            db.flush()
             db.refresh(product)
 
             logger.info(f"Updated product {product_id} in vendor {vendor_id} catalog")
             return product
 
         except ProductNotFoundException:
-            db.rollback()
             raise
         except Exception as e:
-            db.rollback()
             logger.error(f"Error updating product: {str(e)}")
             raise ValidationException("Failed to update product")
 
@@ -198,7 +194,6 @@ class ProductService:
             product = self.get_product(db, vendor_id, product_id)
 
             db.delete(product)
-            db.commit()
 
             logger.info(f"Deleted product {product_id} from vendor {vendor_id} catalog")
             return True
@@ -206,7 +201,6 @@ class ProductService:
         except ProductNotFoundException:
             raise
         except Exception as e:
-            db.rollback()
             logger.error(f"Error deleting product: {str(e)}")
             raise ValidationException("Failed to delete product")