feat: finalize root api.py with X-Auth-Secret auth security and clean pure sales cohort

core/database.py

@@ -0,0 +1,34 @@
+"""
+core/database.py
+SQLite connection manager with WAL mode for high-concurrency REST reads.
+"""
+
+import sqlite3
+from contextlib import contextmanager
+from pathlib import Path
+
+DB_PATH = Path(__file__).resolve().parent.parent / "data" / "hiffi_catalog.db"
+
+
+def get_connection() -> sqlite3.Connection:
+    DB_PATH.parent.mkdir(parents=True, exist_ok=True)
+    conn = sqlite3.connect(str(DB_PATH), check_same_thread=False)
+    conn.row_factory = sqlite3.Row
+    # Configure WAL mode and busy timeout for concurrent API reads
+    conn.execute("PRAGMA journal_mode = WAL;")
+    conn.execute("PRAGMA synchronous = NORMAL;")
+    conn.execute("PRAGMA busy_timeout = 5000;")
+    return conn
+
+
+@contextmanager
+def get_db():
+    conn = get_connection()
+    try:
+        yield conn
+        conn.commit()
+    except Exception:
+        conn.rollback()
+        raise
+    finally:
+        conn.close()