fix: validate and serialize AI discovery runs

[atomantic]

Summary

• Validate and bound full-discovery requests before provider work begins.
• Serialize discovery per family database, with cancellation, timeout handling, and reliable guard cleanup.
• Cover invalid inputs, conflicts, cancellation, provider failure, and active-run retention.

Tests

• npm test -- --run
• npx vitest run tests/integration/api/ai-discovery.spec.ts
• npm run build

Closes #159