perf: reuse db session in multi-account endpoints (#714)

each db_session() creates a new Neon connection (~77ms overhead).
the multi-account endpoints were creating 3 separate connections:
1. require_auth -> get_session()
2. get_session_group()
3. switch_active_account() or artist lookup

now get_session_group() and switch_active_account() accept optional
db parameter to reuse an existing connection. endpoints pass their
injected db through, reducing connection overhead by ~154ms.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.5 <[e-mail]>

backend/src/backend/_internal/auth.py

···
 from fastapi import Cookie, Header, HTTPException
 from jose import jwk
 from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
 
 from backend._internal.oauth_stores import PostgresStateStore
 from backend.config import settings
···
     session_id: str
 
 
-async def get_session_group(session_id: str) -> list[LinkedAccount]:
-    """get all accounts in the same session group.
+async def _get_session_group_impl(
+    session_id: str, db: AsyncSession
+) -> list[LinkedAccount]:
+    """implementation of get_session_group using provided db session."""
+    result = await db.execute(
+        select(UserSession.group_id).where(UserSession.session_id == session_id)
+    )
+    group_id = result.scalar_one_or_none()
 
-    returns empty list if session has no group_id (single account).
-    """
-    async with db_session() as db:
-        result = await db.execute(
-            select(UserSession.group_id).where(UserSession.session_id == session_id)
+    if not group_id:
+        return []
+
+    result = await db.execute(
+        select(UserSession).where(
+            UserSession.group_id == group_id,
+            UserSession.is_developer_token == False,  # noqa: E712
         )
-        group_id = result.scalar_one_or_none()
+    )
+    sessions = result.scalars().all()
 
-        if not group_id:
-            return []
+    accounts = []
+    for session in sessions:
+        if session.expires_at and datetime.now(UTC) > session.expires_at:
+            continue
 
-        result = await db.execute(
-            select(UserSession).where(
-                UserSession.group_id == group_id,
-                UserSession.is_developer_token == False,  # noqa: E712
+        accounts.append(
+            LinkedAccount(
+                did=session.did,
+                handle=session.handle,
+                session_id=session.session_id,
             )
         )
-        sessions = result.scalars().all()
 
-        accounts = []
-        for session in sessions:
-            if session.expires_at and datetime.now(UTC) > session.expires_at:
-                continue
+    return accounts
+
+
+async def get_session_group(
+    session_id: str, db: AsyncSession | None = None
+) -> list[LinkedAccount]:
+    """get all accounts in the same session group.
+
+    returns empty list if session has no group_id (single account).
 
-            accounts.append(
-                LinkedAccount(
-                    did=session.did,
-                    handle=session.handle,
-                    session_id=session.session_id,
-                )
-            )
+    args:
+        session_id: the session to look up
+        db: optional database session to reuse (avoids new connection)
+    """
+    if db is not None:
+        return await _get_session_group_impl(session_id, db)
 
-        return accounts
+    async with db_session() as new_db:
+        return await _get_session_group_impl(session_id, new_db)
 
 
 async def get_or_create_group_id(session_id: str) -> str:
···
         return group_id
 
 
-async def switch_active_account(current_session_id: str, target_session_id: str) -> str:
+async def _switch_active_account_impl(
+    current_session_id: str, target_session_id: str, db: AsyncSession
+) -> str:
+    """implementation of switch_active_account using provided db session."""
+    result = await db.execute(
+        select(UserSession).where(UserSession.session_id == current_session_id)
+    )
+    current_session = result.scalar_one_or_none()
+
+    if not current_session or not current_session.group_id:
+        raise HTTPException(status_code=400, detail="no session group found")
+
+    result = await db.execute(
+        select(UserSession).where(UserSession.session_id == target_session_id)
+    )
+    target_session = result.scalar_one_or_none()
+
+    if not target_session:
+        raise HTTPException(status_code=404, detail="target session not found")
+
+    if target_session.group_id != current_session.group_id:
+        raise HTTPException(status_code=403, detail="target session not in same group")
+
+    if target_session.expires_at and datetime.now(UTC) > target_session.expires_at:
+        raise HTTPException(status_code=401, detail="target session expired")
+
+    return target_session_id
+
+
+async def switch_active_account(
+    current_session_id: str, target_session_id: str, db: AsyncSession | None = None
+) -> str:
     """switch to a different account within a session group.
 
     validates that the target session exists, is in the same group, and isn't expired.
     returns the target session_id (caller updates the cookie).
+
+    args:
+        current_session_id: the current session
+        target_session_id: the session to switch to
+        db: optional database session to reuse (avoids new connection)
     """
-    async with db_session() as db:
-        # get current session to find group_id
-        result = await db.execute(
-            select(UserSession).where(UserSession.session_id == current_session_id)
+    if db is not None:
+        return await _switch_active_account_impl(
+            current_session_id, target_session_id, db
         )
-        current_session = result.scalar_one_or_none()
 
-        if not current_session or not current_session.group_id:
-            raise HTTPException(status_code=400, detail="no session group found")
-
-        # verify target session is in the same group
-        result = await db.execute(
-            select(UserSession).where(UserSession.session_id == target_session_id)
+    async with db_session() as new_db:
+        return await _switch_active_account_impl(
+            current_session_id, target_session_id, new_db
         )
-        target_session = result.scalar_one_or_none()
-
-        if not target_session:
-            raise HTTPException(status_code=404, detail="target session not found")
-
-        if target_session.group_id != current_session.group_id:
-            raise HTTPException(
-                status_code=403, detail="target session not in same group"
-            )
-
-        # check if target session is expired
-        if target_session.expires_at and datetime.now(UTC) > target_session.expires_at:
-            raise HTTPException(status_code=401, detail="target session expired")
-
-        return target_session_id
 
 
 async def remove_account_from_group(session_id: str) -> str | None:

backend/src/backend/api/auth.py

···
     switch_to: Annotated[
         str | None, Query(description="DID to switch to after logout")
     ] = None,
+    db=Depends(get_db),
 ) -> JSONResponse:
     """logout current user.
 
···
     to the specified account. otherwise, fully logs out.
     """
     if switch_to:
-        # validate target is in same group
-        linked = await get_session_group(session.session_id)
+        # validate target is in same group (reuse db connection)
+        linked = await get_session_group(session.session_id, db=db)
         target = next((a for a in linked if a.did == switch_to), None)
 
         if not target:
···
     db=Depends(get_db),
 ) -> CurrentUserResponse:
     """get current authenticated user with linked accounts."""
-    # get all accounts in the session group
-    linked = await get_session_group(session.session_id)
+    # get all accounts in the session group (reuse db connection)
+    linked = await get_session_group(session.session_id, db=db)
 
     # look up artist profiles to get fresh avatars
     dids = [account.did for account in linked]
···
     body: SwitchAccountRequest,
     response: Response,
     session: Session = Depends(require_auth),
+    db=Depends(get_db),
 ) -> SwitchAccountResponse:
     """switch to a different account in the session group.
 
···
 
     returns the new active account's info.
     """
-    # get all accounts in the group
-    linked = await get_session_group(session.session_id)
+    # get all accounts in the group (reuse db connection)
+    linked = await get_session_group(session.session_id, db=db)
 
     if not linked:
         raise HTTPException(
···
             detail="already logged in as this account",
         )
 
-    # switch the active account
-    new_session_id = await switch_active_account(session.session_id, target.session_id)
+    # switch the active account (reuse db connection)
+    new_session_id = await switch_active_account(
+        session.session_id, target.session_id, db=db
+    )
 
     # update the cookie to point to the new session
     if settings.frontend.url:
···
 @router.post("/logout-all")
 async def logout_all(
     session: Session = Depends(require_auth),
+    db=Depends(get_db),
 ) -> JSONResponse:
     """logout all accounts in the session group.
 
     removes all sessions in the group and clears the cookie.
     """
-    # get all accounts in the group
-    linked = await get_session_group(session.session_id)
+    # get all accounts in the group (reuse db connection)
+    linked = await get_session_group(session.session_id, db=db)
 
     # delete all sessions (or just this one if not in a group)
     if linked: