refactor(catalog): the HTTP layer reads through queries and writes through the service

Channels, search and sync do no database work in their routes any more: reads go through
catalog/queries, writes through catalog/service, and a live search's ingest is catalog/search.
What a catalog route needs from Reader (a playlist's channels, a user's tag links, the feed
projection of results) it asks reader/queries and reader/service. The scheduler and the runs page
read channel titles and the work queue through catalog/queries. Catalog is fenced below its HTTP
layer: its owner filters go through userscope, it reads no other unit's tables, and its ingest
jobs commit only where they are named.

backend/tests/test_route_conventions.py

@@ -20,9 +20,6 @@ COMMITTING_HELPERS = {
     "not hand the token back",
     "auth.py:_complete_link": "the tail of the Google callback route, which answers with its result",
     "auth.py:_register_account": "a background task with its own session, i.e. a job wrapper",
-    "search.py:_ingest_candidates": "stages around YouTube calls: the stubs must survive an enrich "
-    "that fails",
-    "search.py:_classify_shorts": "the last stage of that ingest, after its probes",
     "auth.py:upsert_pending_invite": "commits only when it writes — the contract its two "
     "callers rely on (`_register_account` persists its own flushed user because a no-op here "
     "commits nothing)",