security(trees): fix race condition in PlantTreeWithTFTF job

[Snider]

Parent audit: #47

Finding

Non-atomic check-decrement on tree reserve creates a race condition in the PlantTreeWithTFTF job. Concurrent jobs could over-decrement the reserve counter.

Location

• src/Mod/Trees/Jobs/PlantTreeWithTFTF.php

Fix

Wrap the check-and-decrement logic in a database transaction with a pessimistic lock (lockForUpdate()), ensuring atomicity.

Acceptance Criteria

• Reserve check and decrement are wrapped in a DB transaction
• Pessimistic lock (lockForUpdate()) is used on the reserve row
• Concurrent job execution cannot over-decrement the reserve
• Existing tests updated to cover concurrent execution scenario

[Snider]

Parent: #104