fix: eliminate nested database sessions to prevent table locks

Refactor functions that created their own sessions when called from
within existing transactions, which caused "database table is locked"
errors in SQLite's shared-cache mode.

Changes:
- Add files.CreateWithSession() to reuse caller's session
- Refactor DeleteBackgroundFileIfExists() to accept session parameter
- Add variadic session parameter to notifications.Notify() and
  Notifiable.ShouldNotify() interface
- Update all Notify callers (~17 sites) to pass their session through
- Use files.CreateWithSession in SaveBackgroundFile and NewAttachment
- Fix test code to commit sessions before assertions

pkg/modules/auth/openid/openid_test.go

@@ -218,6 +218,8 @@ func TestGetOrCreateUser(t *testing.T) {
 		teamData := getTeamDataFromToken(cl.VikunjaGroups, nil)
 		err := models.SyncExternalTeamsForUser(s, u, teamData, "https://some.issuer", "OIDC")
 		require.NoError(t, err)
+		err = s.Commit()
+		require.NoError(t, err)
 
 		db.AssertMissing(t, "team_members", map[string]interface{}{
 			"team_id": 14,