fix: close DB session in run_step finally block

Wraps the SessionLocal body in try/finally so db.close() is always
called, preventing connection leaks on exception. Updates the
test monkeypatch to use a no-op close() proxy so the transactional
fixture stays live after run_step returns.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

backend/tests/test_orchestrator.py

@@ -434,9 +434,18 @@ def test_run_step_upserts_weekly_run(db, family, monkeypatch):
         "app.services.orchestrator.steps.ScraperService.run_scrape",
         lambda self, **kw: {"status": "success", "items_scraped": 0},
     )
+
+    class _NoCloseSession:
+        """Proxy that delegates all attribute access to the test session
+        but turns close() into a no-op so the transactional fixture stays live."""
+        def __getattr__(self, name):
+            return getattr(db, name)
+        def close(self):
+            pass
+
     monkeypatch.setattr(
         "app.services.orchestrator.runner.SessionLocal",
-        lambda: db,
+        lambda: _NoCloseSession(),
     )
     from app.services.orchestrator.runner import run_step
     run_step("scrape", WEEK)