Data change signals pre-/post-commit

[jace]

Several models have data change signals that are dispatched by views. The current protocol is to raise the signal before a database commit, allowing the signal handler to validate and correct, or raise an exception.

However, if a signal handler needs to dispatch a background job, it is only safe to do that after the database commit. This requires a decision:

1. Raise all data change signals after db commit, forgoing the validation ability. We don't seem to be using that anywhere, instead performing model-level validations. Each signal handler is responsible for its own database commit if it makes changes.

2. Create separate pre- and post-commit signals, the way SQLAlchemy has them. This may be unnecessary bloat though.

3. Create a mechanism for post-commit or request teardown callback in which the background job is dispatched. Flask already offers this, but we risk attempting to run a job even if the database commit fails.

Option 1 seems the cleanest, pending audit of the current signal handlers.