fix: make stream state transitions concurrency-safe

[greatest0fallt1me]

Summary

• Serialize balance-affecting transitions per stream across provider awaits.
• Add versioned compare-and-set persistence so stale writers cannot overwrite newer state.
• Return the committed stream version and include it in transition outbox payloads.
• Reject terminal-state replays and preserve state when a provider operation fails.
• Document the concurrency contract and add deterministic deferred-provider race tests.

Transition contract

The in-memory store now guards each stream transition with a per-stream async lock and a version predicate. Exactly one request can commit a transition for an observed version; queued requests re-read the resulting state and receive an actionable conflict when the requested transition is no longer valid. Provider failures release the lock without advancing state, allowing a safe retry.

This preserves the existing stream status values and outbox event keys. Legacy records without a stored version are treated as version one for their first guarded transition.

Validation

• npm test — 166 passing, 0 failing
• node --check src/store/index.js
• node --check src/services/streamService.js
• node --check test/streamConcurrency.test.js
• git diff --check
• 523 lines added across implementation, tests, and documentation

Related issue

Closes #71