feat: per-task database sessions to prevent session state leakage

[drazisil-codecov]

Summary

Addresses "session in prepared state" errors by creating isolated database sessions for each task execution instead of sharing a global scoped session.

Problem

When tasks share a global scoped session (get_db_session()), session state can leak between tasks:

1. A transaction gets partially prepared (2-phase commit state)
2. The session is reused by another task before cleanup
3. The new task tries to use the corrupted session → InvalidRequestError: session in 'prepared' state

Solution

Create isolated per-task sessions using a new create_task_session() function:

• Each task gets its own session in run()
• Session is properly cleaned up in finally block (rollback + close)
• Routing lookups in apply_async() and route_task() also use temporary sessions

Changes

File	Change
database/engine.py	Add TaskSessionManager, create_task_session(), set_test_session_factory()
tasks/base.py	Use per-task sessions in run() and apply_async() with proper cleanup
celery_task_router.py	Use temporary session for routing lookups
tasks/tests/utils.py	Update hook_session() to configure test session factory
Test files	Update mocks to use create_task_session

Minimal Scope

This PR is intentionally minimal (6 files vs 22 in the original). Services that call obj.get_db_session() will naturally get the correct task session because objects queried via the task session are bound to it.

Explicit db_session=db_session plumbing can be added in a follow-up PR if needed.

Testing

• Updated unit tests to mock create_task_session instead of get_db_session
• Added set_test_session_factory() for test session injection
• hook_session() utility updated to work with new architecture

---

Note

Introduces isolated SQLAlchemy sessions per worker task and uses temporary sessions for routing to prevent session state leakage.

• Add TaskSessionManager with create_task_session() and set_test_session_factory() in database/engine.py
• Update BaseCodecovTask: use per-task session in run() (commit on success, robust rollback/close in _cleanup_task_session); apply_async() now does routing lookups with a temp session; preserve headers/metrics
• Update celery_task_router.route_task to use a temporary session for plan/owner lookups with safe cleanup
• Allow optional db_session plumbing in services.timeseries.upsert_components_measurements and tasks.save_commit_measurements
• Revise tests to hook and mock create_task_session; add test utilities to inject shared test session and prevent test-transaction cleanup

^{Written by Cursor Bugbot for commit 640146d. This will update automatically on new commits. Configure here.}

[drazisil-codecov]

Closing as won't do - the scope of this change (per-task database sessions) is significant and the user impact from the "session in prepared state" errors doesn't justify the risk/effort at this time.