Refactor Minor API Layer Direct DB Access

[gzark1]

Description

Several API files contain direct database queries that should use existing or new repositories for consistency with the layered architecture.

Steps to Reproduce

1. Open backend/api/courses.py - lines 68, 96, 130, 154, 189
2. Open backend/api/profiles.py - lines 109, 118
3. Open backend/api/users.py - lines 75-76, 138
4. Note: All use db.execute() directly

Expected Behavior

API layer should call repositories instead of executing queries directly.

Actual Behavior

api/courses.py (CourseRepository exists but is not used here):

• Line 68: db.execute(query) for course listing
• Line 96: db.execute(select(Course)...) for single course
• Lines 130, 154, 189: Tag/skill queries

api/profiles.py:

• Lines 109-118: Direct queries for profile history endpoint (should use UserProfileRepository.get_snapshots())

api/users.py:

• Lines 75-76: db.add(user), db.commit() for password change
• Line 138: db.execute(select(Course)...) for recommendation history enrichment

Root Cause

• CourseRepository exists in repositories/course_repository.py but API does not use it
• UserProfileRepository.get_snapshots() exists but api/profiles.py duplicates the query
• Inconsistent application of layered architecture across the codebase

Possible Solutions

1. Option A: Use existing repositories

   • Use CourseRepository in api/courses.py
   • Use UserProfileRepository.get_snapshots() in api/profiles.py
   • Add get_all_tags(), get_all_skills() to CourseRepository

2. Option B: Accept as pragmatic choice

   • These are simple read-only queries with no business logic
   • Document that simple selects in API layer are acceptable
   • Focus refactoring effort on admin.py (Issue 1) instead