Decouple endpoints from business logic

[jonathan-d-zhang]

We should extract as much business logic out of our endpoint functions as possible. This will give a number of benefits:

• Easier testability. No longer have to make real requests to test business logic. Integration tests will be slimmed down substantially.
• Easier management of database connection lifecycle. Currently, the issues with FastAPI's DI (see Investigate performance issues introduced by 9db3e05 #235) have led to very confusing handling of database connections and sessions. Leaving the connection handling entirely to the endpoint function will simplify our handling inside the business logic.
• Unify SQL queries. Currently at least a few DB functions are repeated (looking up a package, for example). Extracting these queries to a separate module will let us deduplicate and isolate (SQL) security issues to one spot.

This effort will take a few PRs. My plan so far is to have each endpoint file refactoring take 1 PR each.

Extract business logic from these endpoints:

• Extract business logic from package.py endpoints #296
• Extract business logic from job.py endpoints #297
• Extract business logic from report.py endpoints #298
• Extract business logic from rules.py endpoints #299

stats.py is missing because it's already in a good spot (and we want to nuke it soon).

The general idea is to extract sql queries to src/mainframe/database.py and deduplicate them + pull as much logic out of the endpoint functions as possible.