Reduce handler request boilerplate

- Add session.Attach to reuse per-request sessions across middleware and ghome handlers
- Make Session finalize/abort paths idempotent to avoid duplicate commit or rollback work
- Move request_data parsing helper to internal/utils
- Expand ParseRequestData usage across api, download, unit, live, multiunit, and subscenario handlers
- Extract download package metadata into internal/handler/download/types.go
- Return explicit errors from selected session lookup helpers and update callers
- Make api action handlers return errors directly instead of calling ss.CheckErr in nested layers

Signed-off-by: Sean Du <do4suki@gmail.com>

internal/handler/login/login.go

@@ -19,7 +19,10 @@ func login(ctx *gin.Context) {
 	ss := session.Get(ctx)
 	defer ss.Finalize()
 
-	has, authKeyData := ss.GetAuthKey(ctx.MustGet("token").(string))
+	has, authKeyData, err := ss.GetAuthKey(ctx.MustGet("token").(string))
+	if ss.CheckErr(err) {
+		return
+	}
 	if !has {
 		ss.Abort(errors.New("invalid token"))
 		return