fix: add use_conn() context manager to prevent SQLite connection leak

[Tomatoooogerambo]

kanban_db.connect() returned an open connection with no safety net. 22 callers in plugin_api.py had to manually try/finally/conn.close(), making it easy to leak connections (~1MB each) on any code path that forgets the cleanup.

Changes:

• Add use_conn(db_path, board) context manager to kanban_db.py that wraps connect() with auto-close on exit
• Convert _conn() in plugin_api.py to a @contextlib.contextmanager using use_conn() internally
• Migrate all 22 dashboard API handlers from manual conn = _conn(...) / try/finally/conn.close() to with _conn(...) as conn: (automatic close)

The existing connect() function is preserved for callers that need to return a connection (dispatcher, event stream).

What does this PR do?

Related Issue

Fixes #

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

How to Test

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform:

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

For New Skills

• This skill is broadly useful to most users (if bundled) — see Contributing Guide
• SKILL.md follows the standard format (frontmatter, trigger conditions, steps, pitfalls)
• No external dependencies that aren't already available (prefer stdlib, curl, existing Hermes tools)
• I've tested the skill end-to-end: hermes --toolsets skills -q "Use the X skill to do Y"

Screenshots / Logs

[alt-glitch]

Related to the kanban SQLite connection leak cluster: #28802, #28803 (specify helpers), #29525, #30027, #30031 (boards list), #32415 (superset combining decompose + ROLLBACK). This PR adds use_conn() context manager to kanban_db.py and migrates all 22 plugin_api.py handlers — complementary to the decompose/specify/boards-list fixes targeting different call sites.

[Tomatoooogerambo]

@alt-glitch The merge conflict has been resolved. Could you please approve the workflow run? This is my first PR to hermes-agent, so CI is stuck at "awaiting approval". Thanks!

[teknium1]

Thanks for the cleanup work. This automated hermes-sweeper review found that the FD-leak guarantee is already on current main.

• Current main has hermes_cli/kanban_db.py:1789 connect_closing(), which wraps connect() in try/finally and closes the SQLite connection.
• Commit ebe04c66cd940f38da974c5133de28dbd36823a1 (fix(kanban): close kanban.db FD after every connect() in long-lived processes) introduced that helper, migrated the long-lived production call sites, and added regression coverage.
• tests/hermes_cli/test_kanban_db.py:4912 and :4924 verify closure on normal and exceptional exits.
• Dashboard handlers currently close every _conn() acquisition explicitly; see plugins/kanban/dashboard/plugin_api.py:400 and its paired cleanup at :509.

The PR branch is also substantially behind current main, and its connect_closing → use_conn rename would remove a helper used by current production paths such as hermes_cli/kanban_decompose.py:284. Closing as implemented on main.