refactor(core): introduce Unit of Work and remove commits from services

- Add UnitOfWork context manager in domain/unit_of_work.py with commit/rollback/flush API and auto-rollback on exception

- Remove all db.commit() from test_workflow_service (8 calls), notification_service (4 calls), status_service (1 call)

- Services now only stage changes via db.add/db.flush; caller owns the transaction boundary

- Update routers/tests.py: wrap 9 workflow endpoints in UnitOfWork context managers

- Update routers/notifications.py: wrap mark_as_read and mark_all_as_read in UnitOfWork

backend/app/services/notification_service.py

@@ -2,6 +2,9 @@
 
 Provides helpers for generating notifications automatically when test
 state changes occur, plus CRUD for the notifications API.
+
+Functions in this module stage changes via ``db.add()`` / ``db.flush()``
+but do **not** commit.  The caller is responsible for committing.
 """
 
 import uuid
@@ -38,8 +41,7 @@ def create_notification(
         entity_id=entity_id,
     )
     db.add(notif)
-    db.commit()
-    db.refresh(notif)
+    db.flush()
     return notif
 
 
@@ -53,7 +55,6 @@ def mark_as_read(db: Session, notification_id: uuid.UUID, user_id: uuid.UUID) ->
     if notif is None:
         return False
     notif.read = True
-    db.commit()
     return True
 
 
@@ -64,7 +65,6 @@ def mark_all_as_read(db: Session, user_id: uuid.UUID) -> int:
         .filter(Notification.user_id == user_id, Notification.read == False)  # noqa: E712
         .update({"read": True})
     )
-    db.commit()
     return count
 
 
@@ -88,7 +88,6 @@ def cleanup_old_notifications(db: Session, days: int = 90) -> int:
         )
         .delete()
     )
-    db.commit()
     return count