Small framework helpers for repeated boilerplate: AuditLink.for_model, independent_session #523

Tier 3: duplication (low priority)

AuditLink boilerplate

Seven modules repeat the same block, including the same comment:

AuditLink(entity_type=X.__name__, table_name=X.__tablename__, ...)  # Class name, not __tablename__

Examples: feature_flags/module.py:106-115, settings/module.py:129, permissions/module.py:69.

Fix: add an AuditLink.for_model(Model, url_template=..., ...) constructor.

Out-of-band sessions

Several places open a session_factory() session outside the request for good reasons, but each does it by hand: api_tokens/resolver.py:124, permissions/module.py:112, branding/reaper.py:79, users/bootstrap.py:108,129,190.

Fix: add an independent_session(app) async context manager that commits on success and rolls back on error, so the commit-convention exceptions live in one place.