fix(ontology): close the final (non-redirect) response in _fetch_url_sync

The previous rework of the redirect loop closed the response on each
redirect hop but dropped the try/finally around the success path, so the
terminal response (the one actually read and returned) was left
unclosed, leaking the connection back to the pool unclosed under load.

semantica/explorer/routes/ontology.py

@@ -1028,15 +1028,18 @@ def _fetch_url_sync(url: str) -> bytes:
                 _validate_fetch_url(redirect_url)
                 current_url = redirect_url
                 continue
-            resp.raise_for_status()
-            chunks: List[bytes] = []
-            total = 0
-            for chunk in resp.iter_content(65536):
-                total += len(chunk)
-                if total > _MAX_FETCH_BYTES:
-                    raise HTTPException(status_code=413, detail="Remote resource exceeds 20 MB limit.")
-                chunks.append(chunk)
-            return b"".join(chunks)
+            try:
+                resp.raise_for_status()
+                chunks: List[bytes] = []
+                total = 0
+                for chunk in resp.iter_content(65536):
+                    total += len(chunk)
+                    if total > _MAX_FETCH_BYTES:
+                        raise HTTPException(status_code=413, detail="Remote resource exceeds 20 MB limit.")
+                    chunks.append(chunk)
+                return b"".join(chunks)
+            finally:
+                resp.close()  # Release the streamed connection once fully read (or on error)
         raise HTTPException(status_code=502, detail=f"Too many redirects (max {_MAX_REDIRECTS}).")
     except HTTPException:
         raise