refactor(vendor): migrate db.commit() from service to endpoints (SVC-006)

vendor_service.py:
- Remove 6 db.commit() calls from service methods
- Use db.flush() in create methods to get IDs without committing
- Remove db.rollback() calls (endpoint handles transaction)
- Methods affected: create_vendor, toggle_verification, set_verification,
  toggle_status, set_status, add_product_to_catalog

vendors.py (endpoints):
- Add db.commit() after set_verification() call
- Add db.commit() after set_status() call

This follows the industry pattern: one request = one transaction,
with commit controlled at the API endpoint level.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

app/api/v1/admin/vendors.py

@@ -240,6 +240,7 @@ def toggle_vendor_verification(
         vendor, message = vendor_service.set_verification(
             db, vendor.id, verification_data["is_verified"]
         )
+        db.commit()  # ✅ ARCH: Commit at API level for transaction control
         logger.info(f"Vendor verification updated: {message}")
 
     return VendorDetailResponse(
@@ -290,6 +291,7 @@ def toggle_vendor_status(
         vendor, message = vendor_service.set_status(
             db, vendor.id, status_data["is_active"]
         )
+        db.commit()  # ✅ ARCH: Commit at API level for transaction control
         logger.info(f"Vendor status updated: {message}")
 
     return VendorDetailResponse(