It polls the client at regular intervals and does exactly what lucky said, it INSERTs unknown transactions, and updates the confirmations of the known ones (and no, the tx_id is not defined as unique )
It polls the client for each account, not for a global listtransactions (which doesn't really seem to work anyway AFAIK).
Yes, this approach is sub-optimal, but IMO it's the only one that allows enough flexibility in the ways you want to deal with the data.
I'm completely conscious of the limitations and possible security flaws of this approach, and that's why the bitcoin central code *also* takes advantage of the accounts functionality, providing a second security layer.
That, IMHO is the best possible approach for a web app.