fix(api): cegah race condition pada register users.json (TOCTOU)

- Tambah users_lock (Mutex) di ApiState untuk serialisasi read-modify-write
  users.json pada endpoint register; lock hanya dipegang selama operasi
  file sinkron (tidak pernah lintas .await, menjaga future tetap Send)
- Hash password dihitung sebelum lock sehingga request concurrent tidak
  saling blokir selama hashing Argon2

apps/interfaces/api/src/state.rs

@@ -23,6 +23,7 @@
 use std::fmt;
 use std::future::Future;
 use std::path::PathBuf;
+use std::sync::Arc;
 
 use zesdex_application::ports::{PasswordService, TokenService};
 
@@ -208,6 +209,10 @@ pub struct ApiState {
     /// Shared sliding-window limiter for auth endpoints (login/register/refresh).
     pub auth_rate_limiter: zesdex_infrastructure::middleware::rate_limit::RateLimiter,
 
+    /// Serializes read-modify-write of `users.json` so concurrent register
+    /// requests cannot lose writes (TOCTOU race).
+    pub users_lock: Arc<std::sync::Mutex<()>>,
+
     /// LLM provider client for chat completions.
     pub llm_client: zesdex_infrastructure::llm::provider::LlmClient,
 }
@@ -288,6 +293,7 @@ impl ApiState {
 
         let token_service = JwtTokenService::new(&jwt_secret);
         let auth_rate_limiter = zesdex_infrastructure::middleware::rate_limit::RateLimiter::new();
+        let users_lock = Arc::new(std::sync::Mutex::new(()));
         let llm_client = zesdex_infrastructure::llm::provider::LlmClient::new(
             llm_api_key.into(),
             llm_model.into(),
@@ -304,6 +310,7 @@ impl ApiState {
             password_service: Argon2PasswordService,
             token_service,
             auth_rate_limiter,
+            users_lock,
             llm_client,
         }
     }