db: clean up SQLAlchemy session flushes

Many calls to Session().flush() were completely superfluous and have
been removed. (See also the note on "flush" in the contributor docs.)
For the remaining calls, a comment has been added to explain why it's
necessary.