feat: move all remaining inline logic from routers to services (Tier 2)

backend/app/routers/worklogs.py

@@ -10,9 +10,7 @@ from sqlalchemy.orm import Session
 
 from app.database import get_db
 from app.dependencies.auth import get_current_user, require_any_role
-from app.domain.exceptions import EntityNotFoundError
 from app.models.user import User
-from app.models.worklog import Worklog
 from app.services import worklog_service
 
 router = APIRouter(prefix="/worklogs", tags=["worklogs"])
@@ -97,10 +95,7 @@ def get_one(
     _user: User = Depends(get_current_user),
 ):
     """Get a single worklog by ID."""
-    wl = db.query(Worklog).filter(Worklog.id == worklog_id).first()
-    if not wl:
-        raise EntityNotFoundError("Worklog", str(worklog_id))
-    return wl
+    return worklog_service.get_worklog_or_raise(db, worklog_id)
 
 
 @router.get("/{worklog_id}/verify")
@@ -110,9 +105,7 @@ def verify_integrity(
     _user: User = Depends(get_current_user),
 ):
     """Check whether a worklog's integrity hash is still valid."""
-    wl = db.query(Worklog).filter(Worklog.id == worklog_id).first()
-    if not wl:
-        raise EntityNotFoundError("Worklog", str(worklog_id))
+    wl = worklog_service.get_worklog_or_raise(db, worklog_id)
     return {
         "worklog_id": str(wl.id),
         "integrity_valid": worklog_service.verify_worklog_integrity(wl),