fix: add transaction begin to db.NewSession()

All sessions now start with an active transaction. This makes
multi-statement write operations atomic — if any step fails, all
changes are rolled back instead of leaving the database in an
inconsistent state.

Callers must call s.Commit() for writes to persist. s.Close()
auto-rollbacks uncommitted transactions.

pkg/db/db.go

@@ -403,9 +403,13 @@ func WipeEverything() error {
 	return nil
 }
 
-// NewSession creates a new xorm session
+// NewSession creates a new xorm session with an active transaction.
+// The caller must call s.Commit() on success or s.Rollback() on error.
+// s.Close() will auto-rollback any uncommitted transaction.
 func NewSession() *xorm.Session {
-	return x.NewSession()
+	s := x.NewSession()
+	_ = s.Begin()
+	return s
 }
 
 // Type returns the db type of the currently configured db