Wrap EntityObserver observe calls in per-backend transactions

[sroussey]

Roadmap: prd/roadmap/sec.md

EntityObserver.observePerson / observeCompany perform four writes (observation, canonical, identity-link, junctions) without atomicity. Wrap in withTransaction (SQLite) / Postgres transaction.

Grades: prd/analysis/grades/sec.md recommendation #1