backend: route all outbound User-Agents through core.http_client

[dprodger]

Summary

Follow-up to the shared HTTP session factory (core/http_client.py, merged in #217). The outbound User-Agent string ApproachNote/1.0 (+support@approachnote.com) was copy-pasted into ~20 files; this routes every call site through make_session() / HTTP_USER_AGENT so there's a single source of truth and a version bump is a one-line change.

Changes (17 files, net −34 lines)

Production code

• Integration clients — apple_music, wikipedia, coverart, musicbrainz, youtube — build their session via make_session() (with accept_json=False where they didn't set an Accept header).
• routes/admin.py — MusicBrainz diagnostics session via make_session().
• core/commons_imagery.py — dropped its local USER_AGENT constant and duplicate make_session(); imports the shared one.

Scripts — fetch_artist_images, jazzs_match, jazzs_extract, jazzs_match_authorityrecs, add_wikipedia_image, fetch_loc_images, gather_performers_from_mb_for_release, diagnostics/fix_unknown_leaders, onetime_scripts/one_time_song_wiki_intro use make_session(). save_review_thumbs (otherwise standalone) gets a small backend-path bootstrap so it can import HTTP_USER_AGENT.

Intentionally untouched

• scripts/onetime_scripts/jazz_song_research.py uses a browser (Mozilla/5.0…) User-Agent on purpose to scrape a bot-blocking site.
• Per-service rate limiting stays in each client — the factory only handles identity/headers.

Verification

• All changed files compile; full app imports cleanly (157 routes).
• Clients instantiate with the correct UA at runtime; save_review_thumbs --help runs (bootstrap resolves).
• No ApproachNote/1.0 literal remains outside core/http_client.py.
• 629 backend tests pass against the local test DB.

🤖 Generated with Claude Code