refactor: move transaction management from services to API endpoints

- Services now use db.flush() instead of db.commit() for database operations
- API endpoints handle transaction commit after service calls
- Remove db.rollback() from services (let exception handlers manage this)
- Ensures consistent transaction boundaries at API layer

This pattern gives API endpoints full control over when to commit,
allowing for better error handling and potential multi-operation transactions.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/services/vendor_team_service.py

@@ -112,7 +112,7 @@ class VendorTeamService:
                     )
                     existing_membership.invitation_sent_at = datetime.utcnow()
                     existing_membership.invitation_accepted_at = None
-                    db.commit()
+                    db.flush()
 
                     logger.info(
                         f"Re-invited user {email} to vendor {vendor.vendor_code}"
@@ -170,7 +170,7 @@ class VendorTeamService:
                 is_active=False,  # Will be activated on acceptance
             )
             db.add(vendor_user)
-            db.commit()
+            db.flush()
 
             logger.info(
                 f"Invited {email} to vendor {vendor.vendor_code} "
@@ -190,7 +190,6 @@ class VendorTeamService:
         except (TeamMemberAlreadyExistsException, MaxTeamMembersReachedException):
             raise
         except Exception as e:
-            db.rollback()
             logger.error(f"Error inviting team member: {str(e)}")
             raise
 
@@ -255,7 +254,7 @@ class VendorTeamService:
             vendor_user.invitation_accepted_at = datetime.utcnow()
             vendor_user.invitation_token = None  # Clear token
 
-            db.commit()
+            db.flush()
 
             logger.info(
                 f"User {user.email} accepted invitation to vendor {vendor.vendor_code}"
@@ -273,7 +272,6 @@ class VendorTeamService:
         ):
             raise
         except Exception as e:
-            db.rollback()
             logger.error(f"Error accepting invitation: {str(e)}")
             raise
 
@@ -315,7 +313,6 @@ class VendorTeamService:
 
             # Soft delete - just deactivate
             vendor_user.is_active = False
-            db.commit()
 
             logger.info(f"Removed user {user_id} from vendor {vendor.vendor_code}")
             return True
@@ -323,7 +320,6 @@ class VendorTeamService:
         except (UserNotFoundException, CannotRemoveOwnerException):
             raise
         except Exception as e:
-            db.rollback()
             logger.error(f"Error removing team member: {str(e)}")
             raise
 
@@ -374,7 +370,7 @@ class VendorTeamService:
             )
 
             vendor_user.role_id = new_role.id
-            db.commit()
+            db.flush()
 
             logger.info(
                 f"Updated role for user {user_id} in vendor {vendor.vendor_code} "
@@ -386,7 +382,6 @@ class VendorTeamService:
         except (UserNotFoundException, CannotRemoveOwnerException):
             raise
         except Exception as e:
-            db.rollback()
             logger.error(f"Error updating member role: {str(e)}")
             raise