feat(db): concurrency and race safety in src/db/

[samuel22x]

Serialization/conflict behavior, retry contracts, deterministic test coverage, and operational signals.

Changes:

• retry.ts: add PG 55P03 (lock_timeout) to isRetryableError() so the retry loop exhausts attempts before surfacing ConflictError with conflictCode='lock_timeout', matching the same contract as serialization failures and deadlocks.
• retry.ts: ConflictError (with retryAfterSeconds, attempts, conflictCode) thrown after retry exhaustion for all concurrency conflicts; MaxRetriesExhaustedError only for non-conflict exhaustion.
• transaction.ts: TransactionManager with configurable LockTimeoutPolicy, post-commit hooks (cache invalidation, metrics), rollback hooks (compensating actions), AsyncLocalStorage context propagation, transaction budget (duration + savepoints), and RLS tenant_id injection.
• settlementsRepository.ts: atomic xmax-based upsert (eliminates TOCTOU SELECT+INSERT race), TransactionManager.withTransaction for upsertBatch atomicity.
• concurrency.test.ts: 26 deterministic unit tests covering parallel writes, contention, retry-after-conflict, partial-state invariants, post/rollback hook isolation, and cache invalidation deferral.
• docs/DB_CONCURRENCY.md: design, invariants, failure behavior, compatibility impact, migration/rollback, operational limitations, and security assumptions.

Closes #1275

[drips-wave]

@samuel22x Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits