fix: atomic state transitions + race-loser handling for concurrent workers

[ancongui]

Summary

• Every state-changing repository method is now a single atomic UPDATE … WHERE id=? AND status IN (legal_predecessors) RETURNING *. Concurrent writers get serialised by Postgres' row-level UPDATE lock; the WHERE precondition picks one winner and gives None to the loser. The lost-update + duplicate-processing bugs are gone.
• mark_running and mark_bbox_refining accept a lease_seconds window so a worker crashing mid-run is recoverable on redelivery (stale lease → reclaim) but a fresh redelivery to a peer worker is rejected (fresh lease → bail).
• Cancel handler is a single conditional UPDATE: the cancel/worker-claim race is settled by Postgres, not by a Python-side check.
• Submit handler catches the IntegrityError from concurrent same-idempotency-key submits and returns the idempotent shape instead of a 500.
• Workers (job + bbox) silently bail when their atomic claim returns None, and skip webhooks / republishes when finalisation didn't actually win.
• 25 new unit tests + 5 real-Postgres integration tests. 340 passing total (was 286).

What was broken

Bug	Before	After
Two replicas dispatch the same event in parallel	both run LLM extraction, both mark_running increments lose updates, both mark_succeeded last-writer-wins, webhook delivered twice	exactly one worker claims; loser bails silently
Cancel races with worker claim	TOCTOU window between SELECT + mark_cancelled; could clobber a RUNNING job to CANCELLED then worker still finishes	atomic mark_cancelled WHERE status='QUEUED'; exactly one of cancel/claim wins
Concurrent submit with same idempotency_key	second submit hits unique-index violation → 500	catches IntegrityError, re-resolves winner, returns idempotent 202
Worker crash mid-run	redelivered event re-claims unconditionally, attempts double-counted	stale lease → atomic re-claim with one attempt increment; fresh lease excludes peers
update(status='QUEUED') retry path	could clobber a concurrent cancel	atomic requeue_for_retry WHERE status='RUNNING'

Companion change

Requires fireflyframework-pyfly#13 (per-group advisory lock on PostgresEventBus._drain). Merged.

Test plan

• tests/unit/test_extraction_job_repository.py — 18 tests against SQLite covering happy path + race losses + stale-lease reclaim + concurrent winners.
• tests/unit/test_worker_concurrency.py — 5 tests verifying workers bail / don't double-fire webhooks when claims or finalisations return None.
• tests/unit/test_submit_job_handler.py — 2 new tests for the IntegrityError recovery and re-raise paths.
• tests/integration/test_postgres_concurrency.py — 4 real-Postgres tests for atomic transitions, cancel-vs-claim race, stale-lease reclaim, finalisation idempotency.
• tests/integration/test_eda_advisory_lock.py — 2 concurrent PostgresEventBus instances against real Postgres deliver each of 20 events exactly once across the pair (no duplicates).
• Full unit suite: 293 passed, 1 skipped (was 286, +7 net; +25 new minus refactored stubs).
• Combined with pyfly EDA + integration: 340 passed, 1 skipped.