refactor(catalog): the HTTP layer reads through queries and writes through the service

Channels, search and sync do no database work in their routes any more: reads go through
catalog/queries, writes through catalog/service, and a live search's ingest is catalog/search.
What a catalog route needs from Reader (a playlist's channels, a user's tag links, the feed
projection of results) it asks reader/queries and reader/service. The scheduler and the runs page
read channel titles and the work queue through catalog/queries. Catalog is fenced below its HTTP
layer: its owner filters go through userscope, it reads no other unit's tables, and its ingest
jobs commit only where they are named.

backend/app/sync/subscriptions.py

@@ -11,6 +11,7 @@ from app.models import User
 from app.catalog.models import Channel, Subscription
 from app.utils import normalize_description
 from app.youtube.client import YouTubeClient, YouTubeError, best_thumbnail
+from app.userscope import owned_by
 
 log = logs.get_logger(__name__)
 
@@ -173,7 +174,7 @@ def import_subscriptions(db: Session, user: User) -> dict:
                 new_channels += 1
             sub_row = db.execute(
                 select(Subscription).where(
-                    Subscription.user_id == user.id, Subscription.channel_id == cid
+                    owned_by(Subscription.user_id, user.id), Subscription.channel_id == cid
                 )
             ).scalar_one_or_none()
             if sub_row is None:
@@ -186,7 +187,9 @@ def import_subscriptions(db: Session, user: User) -> dict:
         # (see `should_prune`).
         removed = 0
         existing = (
-            db.execute(select(Subscription).where(Subscription.user_id == user.id)).scalars().all()
+            db.execute(select(Subscription).where(owned_by(Subscription.user_id, user.id)))
+            .scalars()
+            .all()
         )
         prune_skipped = not should_prune(len(fetched), len(existing))
         if prune_skipped: