fix: close DB session in run_step finally block

Wraps the SessionLocal body in try/finally so db.close() is always
called, preventing connection leaks on exception. Updates the
test monkeypatch to use a no-op close() proxy so the transactional
fixture stays live after run_step returns.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

backend/app/services/orchestrator/runner.py

@@ -63,6 +63,7 @@ def run_step(step_name: str, week_start_date: Optional[date] = None) -> None:
 
     week = week_start_date or _current_week_start()
     db = SessionLocal()
+    try:
         families = db.query(FamilyProfile).all()
         if not families:
             logger.warning("run_step(%s): no family profiles, skipping", step_name)
@@ -75,6 +76,8 @@ def run_step(step_name: str, week_start_date: Optional[date] = None) -> None:
                 logger.exception(
                     "run_step(%s) failed for family %s", step_name, family.id
                 )
+    finally:
+        db.close()
 
 
 def run_week(week_start_date: Optional[date] = None) -> None:

backend/tests/test_orchestrator.py

@@ -434,9 +434,18 @@ def test_run_step_upserts_weekly_run(db, family, monkeypatch):
         "app.services.orchestrator.steps.ScraperService.run_scrape",
         lambda self, **kw: {"status": "success", "items_scraped": 0},
     )
+
+    class _NoCloseSession:
+        """Proxy that delegates all attribute access to the test session
+        but turns close() into a no-op so the transactional fixture stays live."""
+        def __getattr__(self, name):
+            return getattr(db, name)
+        def close(self):
+            pass
+
     monkeypatch.setattr(
         "app.services.orchestrator.runner.SessionLocal",
-        lambda: db,
+        lambda: _NoCloseSession(),
     )
     from app.services.orchestrator.runner import run_step
     run_step("scrape", WEEK)