chore(canopy-applications): wrap create_application + program loop in a transaction

The `create_application` handler inserts the application row and then iterates `programs_requested` creating one program row per entry. There is no enclosing transaction — if the program-loop fails partway, the application row is committed and the half-loaded state is visible to every subsequent query.

Fix: wrap the whole intake (application row + all program rows + any related inserts) in a single `sqlx::Transaction`, committing only on success.

Extracted from application-intake.adoc § Known Gaps.