feat(jobs): per-campaign and per-remote-operation locks

[TheAggressive]

Closes #169. Part of #66 (M5). Rebased onto master after #176 merged. It also carries #178 (the documentation pass), which was merged into this branch while it was #178's base, so landing this PR brings both to master.

What this adds

• Schema 8: {prefix}campaignbridge_locks, behind a Lock_Source port.
  • The primary key admits one holder.
  • Taking over an expired lock is a conditional update with one winner.
  • Only the holder can release, so a process that ran past its expiry can't free a lock someone else now holds.
• Workflow/Lock/Lock_Manager. Holds the lock for the whole operation, provider calls included, and releases it in finally.
  • When the lock is held elsewhere, the work doesn't run. The caller gets the new locked workflow error: REST 409 campaignbridge_campaign_locked with retry_after, the seconds until the lock expires.
  • Abandoned locks expire after 5 minutes. The takeover is audited as campaign_lock_takeover or provider_lock_takeover.
• Campaign lock around draft handoff, test send, schedule, unschedule, send, and reconcile. It covers the draft re-assertion before delivery, which also writes to Mailchimp.
• Remote-operation lock around discovery refreshes, per account and list. An overlapping refresh returns the cached list with a retryable mailchimp_refresh_in_progress instead of a second provider call.
• Timeline: a takeover reads "Recovered an interrupted operation (Interrupted: send)".
• The workflows take the lock manager as an optional last constructor dependency, and the production factories always pass it. Existing tests that build workflows directly are unchanged.

Evidence (#169)

• Campaign_Schedule_Route_Test: while a background worker holds the campaign, send, schedule, test send, and reconcile each return 409 locked with retry_after of 300 seconds or less, and no request reaches Mailchimp. After release, the send goes through with exactly one action and releases its own lock.
• Lock_Manager_Test:
  • the second holder is refused, with the remaining wait;
  • different campaigns don't block each other;
  • the lock is released even when the work throws;
  • only the owner releases;
  • an abandoned lock is taken over and audited with the interrupted operation;
  • racing takeovers have one winner.
• Provider_Discovery_Routes_Test: a refresh run while another holds the lock makes no Mailchimp call and returns the cached list with a retryable refusal.
• Migration: schema 7 → 8 keeps queued jobs, and re-runs are idempotent. The index check covers locks.
• Jest: the timeline label and the interrupted-operation detail.
• SQLite (Studio): a probe ran insert collision, held_until, takeover with the interrupted purpose, one winner of a racing takeover, and owner-only release. Studio was re-stamped to schema 6 afterwards.

Verification

• pnpm qa:fast passes.
• Unit (1126), integration (458), security (117), accessibility (25), and performance (9) suites: all pass.

🤖 Generated with Claude Code