refactor(capture): the HTTP layer reads through queries and writes through the service

Capture's routes (downloads, files, public watch links) and the token list no longer build SQL, call
the session or set a model's fields: reads are downloads/queries, writes the unit's service (service,
folders, links, quota), and each write flushes for the handler to commit. Whose a row is goes
through userscope (owned_by, owned_row), which owned_or_404 now uses too.

The fence holds Capture below its routes as well: it reads only Catalog's and Plex's tables, writes
no other unit's, filters owners through userscope and commits only in its jobs and the upload
ingest. A test per service use case, among them that the tray lists only the caller's files.

backend/tests/test_download_job_locks.py

@@ -89,6 +89,7 @@ def test_overlapping_requests_for_one_job_release_its_hold_once(
         # The second request waits for the first one's locks instead of deciding on the same row.
         assert not finished.wait(0.5), "the second request did not wait for the first"
         transition(first, locked)
+        first.commit()  # the handler's commit: the service only flushes
         other.join(10)
         assert finished.is_set()
     finally: