refactor: remove db.commit() from audit_service.log_action, all callers use UoW

backend/app/domain/unit_of_work.py

@@ -12,8 +12,6 @@ Services should **never** call ``db.commit()``; they use ``db.add()`` /
 ``db.flush()`` to stage work and let the caller decide when to commit.
 
 **Documented exceptions** (services that may commit internally):
-- ``audit_service.log_action`` — called from 15+ routers; commits to ensure
-  audit records persist even when callers do not.
 - Import services (atomic_import, sigma_import, etc.) — self-contained sync ops.
 - Background jobs (campaign_scheduler, intel_service, stale_detection,
   mitre_sync) — self-contained operations.