refactor: remove db.commit() from business services, callers use UnitOfWork (Tier 3)

backend/app/domain/unit_of_work.py

@@ -10,6 +10,16 @@ Usage in routers::
 If an exception propagates, ``__exit__`` issues a rollback automatically.
 Services should **never** call ``db.commit()``; they use ``db.add()`` /
 ``db.flush()`` to stage work and let the caller decide when to commit.
+
+**Documented exceptions** (services that may commit internally):
+- ``audit_service.log_action`` — called from 15+ routers; commits to ensure
+  audit records persist even when callers do not.
+- Import services (atomic_import, sigma_import, etc.) — self-contained sync ops.
+- Background jobs (campaign_scheduler, intel_service, stale_detection,
+  mitre_sync) — self-contained operations.
+- Self-contained batch ops (e.g. detection_rule_service.auto_associate_rules,
+  snapshot_service.create_snapshot, campaign_service.generate_campaign_from_*,
+  osint_enrichment_service.enrich_technique_with_cves).
 """
 
 from __future__ import annotations