Reduce handler request boilerplate

- Add session.Attach to reuse per-request sessions across middleware and ghome handlers
- Make Session finalize/abort paths idempotent to avoid duplicate commit or rollback work
- Move request_data parsing helper to internal/utils
- Expand ParseRequestData usage across api, download, unit, live, multiunit, and subscenario handlers
- Extract download package metadata into internal/handler/download/types.go
- Return explicit errors from selected session lookup helpers and update callers
- Make api action handlers return errors directly instead of calling ss.CheckErr in nested layers

Signed-off-by: Sean Du <do4suki@gmail.com>

internal/middleware/common.go

@@ -36,7 +36,7 @@ func Common(ctx *gin.Context) {
 	uid := ctx.GetHeader("User-ID")
 	ctx.Set("userid", uid)
 
-	ss := session.New(ctx)
+	ss := session.Attach(ctx)
 	ctx.Set("session", ss)
 
 	authorize := ctx.GetHeader("Authorize")