fix(cards): prevent concurrent deletions from removing all user cards

[Ridanshi]

Summary

Fixes a transactional race condition in card deletion that could allow concurrent requests to remove all cards belonging to a user despite intended last-card protection.

Root Cause

The delete flow previously executed:

1. ownership lookup
2. card count validation
3. delete operation

as separate non-transactional database operations.

Under concurrent requests, multiple deletes could simultaneously observe the same card count and proceed, resulting in users ending up with zero cards.

Fix

Moved the deletion guard and delete flow into a single Prisma $transaction using Serializable isolation.

The transaction now atomically performs:

• card ownership validation
• last-card protection
• default-card promotion
• delete operation

This guarantees that concurrent delete requests cannot violate the invariant that a user must always retain at least one card.

Concurrency Behavior

Before:

• two concurrent deletes against 2 cards could both succeed
• final state could become 0 cards

After:

• only one delete can succeed
• competing transaction safely aborts
• user always retains at least one card

Tests Added

Added focused regression coverage for:

• successful delete flow
• default-card promotion
• last-card protection
• concurrent deletion scenarios
• transactional invariant preservation
• failure handling

Files Changed

• apps/backend/src/routes/cards.ts
• apps/backend/src/__tests__/cards.test.ts

Closes #356

[Harxhit]

@Ridanshi Fix merge conflicts and please add terminal screen short proof for unit tests.

[Ridanshi]

Conflicts resolved and branch updated.

Resolution summary:

• Kept upstream's cardService-based delete flow after the refactor.
• Applied the Serializable transaction isolation fix in cardService.deleteCard(), which is now the authoritative deletion path.
• Removed obsolete route-level transaction logic and unused imports.

Unit tests rerun successfully:

npx vitest run src/tests/cards.test.ts --reporter=verbose

Result:
✓ 25/25 tests passed

This includes the concurrency regression coverage added in this PR:

• runs the count check and deletion inside a single transaction
• blocks a concurrent request whose transaction-internal count reflects a prior committed delete
• allows exactly one of two racing deletes to succeed
• user always retains at least one card regardless of which concurrent request wins

Terminal proof attached.