feat: Add per-case dir oneliner locks

Introduces `OnelinerLocks` to serialize read-modify-write operations on
`oneliner.json`. This prevents race conditions between the manual
override API (`PUT /api/cases/{case_id}/oneliner`) and the transcription
worker's auto-regeneration process.

The manual override now acquires a lock specific to the `case_dir`
before writing. The transcription worker's `update_oneliner` function
also acquires the same lock around its post-LLM re-read-and-write
sequence. This ensures that a doctor's manual edit always takes
precedence, even if it arrives while an auto-regeneration is in
progress.

This change also includes:
- A new `routes::oneliner_override` module for the PUT handler.
- Validation for the oneliner text length and emptiness.
- Integration tests for the override functionality, covering happy path,
  error conditions, early latching, race conditions, and parallel PUTs.

server/src/routes/user_web.rs

@@ -451,6 +451,7 @@ impl PipelineState {
                 let vocab = Arc::clone(vocab);
                 let events_tx = events_tx.clone();
                 let busy = Arc::clone(&self.oneliner_heal_busy.0);
+                let locks = self.oneliner_locks.clone();
                 info!(user = %slug, "oneliner heal spawned");
                 tokio::spawn(async move {
                     // `BusyGuard::Drop` resets the flag to `false` — even
@@ -465,6 +466,7 @@ impl PipelineState {
                         &config,
                         &vocab,
                         &events_tx,
+                        &locks,
                     )
                     .await;
                 });