refactor(vendor): migrate db.commit() from service to endpoints (SVC-006)

vendor_service.py:
- Remove 6 db.commit() calls from service methods
- Use db.flush() in create methods to get IDs without committing
- Remove db.rollback() calls (endpoint handles transaction)
- Methods affected: create_vendor, toggle_verification, set_verification,
  toggle_status, set_status, add_product_to_catalog

vendors.py (endpoints):
- Add db.commit() after set_verification() call
- Add db.commit() after set_status() call

This follows the industry pattern: one request = one transaction,
with commit controlled at the API endpoint level.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

app/api/v1/admin/vendors.py

@@ -240,6 +240,7 @@ def toggle_vendor_verification(
         vendor, message = vendor_service.set_verification(
             db, vendor.id, verification_data["is_verified"]
         )
+        db.commit()  # ✅ ARCH: Commit at API level for transaction control
         logger.info(f"Vendor verification updated: {message}")
 
     return VendorDetailResponse(
@@ -290,6 +291,7 @@ def toggle_vendor_status(
         vendor, message = vendor_service.set_status(
             db, vendor.id, status_data["is_active"]
         )
+        db.commit()  # ✅ ARCH: Commit at API level for transaction control
         logger.info(f"Vendor status updated: {message}")
 
     return VendorDetailResponse(

app/services/vendor_service.py

@@ -107,8 +107,7 @@ class VendorService:
             )
 
             db.add(new_vendor)
-            db.commit()
-            db.refresh(new_vendor)
+            db.flush()  # Get ID without committing - endpoint handles commit
 
             logger.info(
                 f"New vendor created: {new_vendor.vendor_code} under company {company.name} by {current_user.username}"
@@ -120,10 +119,8 @@ class VendorService:
             UnauthorizedVendorAccessException,
             InvalidVendorDataException,
         ):
-            db.rollback()
-            raise  # Re-raise custom exceptions
+            raise  # Re-raise custom exceptions - endpoint handles rollback
         except Exception as e:
-            db.rollback()
             logger.error(f"Error creating vendor: {str(e)}")
             raise ValidationException("Failed to create vendor")
 
@@ -310,8 +307,7 @@ class VendorService:
         """
         vendor = self.get_vendor_by_id(db, vendor_id)
         vendor.is_verified = not vendor.is_verified
-        db.commit()
-        db.refresh(vendor)
+        # No commit here - endpoint handles transaction
 
         status = "verified" if vendor.is_verified else "unverified"
         logger.info(f"Vendor {vendor.vendor_code} {status}")
@@ -336,8 +332,7 @@ class VendorService:
         """
         vendor = self.get_vendor_by_id(db, vendor_id)
         vendor.is_verified = is_verified
-        db.commit()
-        db.refresh(vendor)
+        # No commit here - endpoint handles transaction
 
         status = "verified" if is_verified else "unverified"
         logger.info(f"Vendor {vendor.vendor_code} set to {status}")
@@ -359,8 +354,7 @@ class VendorService:
         """
         vendor = self.get_vendor_by_id(db, vendor_id)
         vendor.is_active = not vendor.is_active
-        db.commit()
-        db.refresh(vendor)
+        # No commit here - endpoint handles transaction
 
         status = "active" if vendor.is_active else "inactive"
         logger.info(f"Vendor {vendor.vendor_code} {status}")
@@ -385,8 +379,7 @@ class VendorService:
         """
         vendor = self.get_vendor_by_id(db, vendor_id)
         vendor.is_active = is_active
-        db.commit()
-        db.refresh(vendor)
+        # No commit here - endpoint handles transaction
 
         status = "active" if is_active else "inactive"
         logger.info(f"Vendor {vendor.vendor_code} set to {status}")
@@ -430,11 +423,7 @@ class VendorService:
             )
 
             db.add(new_product)
-            db.commit()
-            db.refresh(new_product)
-
-            # Load the product relationship
-            db.refresh(new_product)
+            db.flush()  # Get ID without committing - endpoint handles commit
 
             logger.info(
                 f"MarketplaceProduct {product.marketplace_product_id} added to vendor {vendor.vendor_code}"
@@ -442,10 +431,8 @@ class VendorService:
             return new_product
 
         except (MarketplaceProductNotFoundException, ProductAlreadyExistsException):
-            db.rollback()
-            raise  # Re-raise custom exceptions
+            raise  # Re-raise custom exceptions - endpoint handles rollback
         except Exception as e:
-            db.rollback()
             logger.error(f"Error adding product to vendor : {str(e)}")
             raise ValidationException("Failed to add product to vendor ")