The one transaction per request model can hold connections for too long

[sandhose]

We currently have a simple model of opening a database transaction for each HTTP request.
This has the benefit of ensuring database consistency through the whole request, and avoid unnecessary waits for database connections to be available mid-request.

This has the downside of potentially holding a database connection open for a long time, if during the request we're calling to external systems, like the upstream OAuth 2.0 provider.

We need to rethink this system to allow a more granular access to the database. I think we should start the database transactions explicitly within the request, so that it's possible to split the request into two separate transactions