Fix Shepherd/JDO connection leaks causing stuck dbconnections entries

[JasonWildMe]

Summary

Fixes a set of PersistenceManager / connection leaks observed on production Sharkbook and Flukebook via dbconnections.jsp (stuck entries at IBEISIA.processCallback:rollback, RestServlet:new, plus in-flight Encounter.opensearchDocumentSerializer:begin and api.Bulk.doGet:begin).

The single commit (993a81e) touches five files with +184 / -150 lines (functional changes only — ignoring CRLF→LF noise in the rest of the tree):

• Shepherd.closeDBTransaction / rollbackDBTransaction — move the ShepherdState writes into finally blocks so state always advances past "begin" and stuck entries stop accumulating. If pm.close() throws, the entry is left as "close-failed" so the dashboard preserves evidence of the leak — the important case, a connection that won't return to the pool. (rollbackDBTransaction also sets "rollback-failed" on a failed rollback, but because callers use rollbackAndClose(), a subsequent successful close() clears the entry by design; so "rollback-failed" is only visible on the dashboard if the close also fails.)
• IBEISIA.processCallback — wrap both Shepherds in try { ... } finally { rollbackAndClose(); }. The bare return rtn; on the no-log path (the source of the IBEISIA.processCallback:rollback stuck entries) now runs the finally. Setup moved inside the try for consistency.
• RestServlet.doPost / doDelete / doHead — outer try/finally around each method body removes the RestServlet.class_<id> state entry on every return path, including doPost's empty-body 400 early return. Fixes the accumulating RestServlet:new entries.
• BulkImport.doGet / doPost — Shepherd construction / setAction / beginDBTransaction moved inside the try with a null-safe finally. Background-thread inner class captures bgContext as final.
• OpenSearch.setPermissionsNeeded / setActive / unsetActive / updatePermissionsIndex / updateEncounterIndexes — same try-with-null-safe-finally hardening.

Known follow-up (out of scope for this PR)

• OpenSearch background reindex still holds a DB connection across HTTP. updatePermissionsIndex and updateEncounterIndexes keep their Shepherd transaction open for the full duration of the per-object OpenSearch HTTP loop (Encounter.opensearchIndexPermissions phase 2 os.indexUpdate(...), and Base.opensearchSyncIndex per-object os.index(...)). The Encounter phase 1/phase 2 refactor here releases the inner Shepherd, but the caller-held connection is not yet addressed. Tracking as a follow-up; this PR does not fully close the Encounter.opensearchDocumentSerializer:begin long-hold.

Test plan

• mvn compile clean (verified locally)
• IBEISIA.processCallback: exercise the no-log early-return path, the successful detect path, and the "no annotations suitable for identification" path; confirm no stuck IBEISIA.processCallback:* entries accumulate on dbconnections.jsp
• RestServlet: POST (empty body + normal), DELETE, HEAD requests while watching dbconnections.jsp — confirm RestServlet:new no longer accumulates
• BulkImport list + detail doGet and doPost/doDelete flows
• Any reproducible pm.close() failure — confirm the dashboard shows close-failed rather than vanishing
• Monitor dbconnections.jsp on staging for 24h post-deploy; confirm entry count stabilizes

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.17%. Comparing base (268f445) to head (7430517).
⚠️ Report is 89 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1553      +/-   ##
==========================================
- Coverage   51.61%   51.17%   -0.45%     
==========================================
  Files         308      308              
  Lines       11976    12073      +97     
  Branches     3824     3798      -26     
==========================================
- Hits         6182     6178       -4     
- Misses       5507     5593      +86     
- Partials      287      302      +15     

Flag	Coverage Δ
backend	51.17% <ø> (-0.45%)	⬇️
frontend	51.17% <ø> (-0.45%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.