refactor(capture): the HTTP layer reads through queries and writes through the service

Capture's routes (downloads, files, public watch links) and the token list no longer build SQL, call
the session or set a model's fields: reads are downloads/queries, writes the unit's service (service,
folders, links, quota), and each write flushes for the handler to commit. Whose a row is goes
through userscope (owned_by, owned_row), which owned_or_404 now uses too.

The fence holds Capture below its routes as well: it reads only Catalog's and Plex's tables, writes
no other unit's, filters owners through userscope and commits only in its jobs and the upload
ingest. A test per service use case, among them that the tray lists only the caller's files.

backend/tests/test_folder_links.py

@@ -194,7 +194,7 @@ def test_every_open_counts_as_a_view(shelf, client):
 
 def test_the_folder_list_is_capped_like_the_owners_files_list():
     from app.downloads import links as linksmod
-    from app.routes.files import MAX_LIST
+    from app.downloads.queries import MAX_LIST
 
     assert linksmod.FOLDER_MAX == MAX_LIST