fix(api): mutations answer ok; route helpers flush and leave the commit to the handler

Two rows of the canonical-patterns table had drifted, found while closing the roadmap audit:

- 63 mutation responses carried no `ok` — `{"unsubscribed": true}`, `{"status": "ok"}`,
  `{"added": 3, …}` and so on. Each now leads with `"ok": true` (additive: every field a client
  reads is still there).
- Twelve route helpers committed on their own. Six were just the end of their handler's work and now
  flush: the playlist item add/remove and Watch later get-or-create, the Plex series/season bulk
  mark, and the invite decision + account activation — which an approval used to land in separate
  transactions. The other six commit on purpose (a token durable before its link is mailed, a
  single-use token burned as its own unit, the Google callback's tail, a background registration
  with its own session, the staged search ingest around YouTube calls), each listed with its reason.

`tests/test_route_conventions.py` holds both rules in code; CLAUDE.md's two rows point at it.

backend/tests/test_plex_query_conversion.py

@@ -436,7 +436,7 @@ class TestPlaylistAndCollectionEndpoints:
             {"item_rating_keys": ["m1", "m2", "m3"]},
         )
         assert added.status_code == 200, added.text
-        assert added.json() == {"added": 3, "item_count": 3}
+        assert added.json() == {"ok": True, "added": 3, "item_count": 3}
 
         removed = _request(
             db,
@@ -448,7 +448,7 @@ class TestPlaylistAndCollectionEndpoints:
             {"item_rating_keys": ["m2"]},
         )
         assert removed.status_code == 200, removed.text
-        assert removed.json() == {"removed": 1, "item_count": 2}
+        assert removed.json() == {"ok": True, "removed": 1, "item_count": 2}
 
         detail = _get(db, user, monkeypatch, override_dep, f"/api/plex/playlists/{pid}").json()
         assert [it["id"] for it in detail["items"]] == [