Add a transaction-scoped routing admission lock

[chet]

Overlap admission is a cross-table check-then-write decision. Two routing-expanding writers cannot independently read the old safe state and both commit. The first implementation needs a conservative shared serialization boundary, but it does not need a generic site-mutation mutex or a new transaction framework.

Scope

• Add one small API-DB transaction type named for routing-graph writes.
• Queue same-process writers behind one in-memory permit before they open a transaction, so local waiters do not consume the database pool.
• Own the transaction and in-memory permit together, so callers cannot release admission before commit or rollback.
• Expose only explicit commit and rollback lifecycle methods for completion. Existing DB helpers may borrow the transaction, but callers cannot take ownership of it or complete it outside the wrapper.
• Use one stable database-local key. A NICo database belongs to one site, so independent site deployments remain independent.
• Acquire the transaction lock immediately after begin and before resource-specific locks.
• Poll the non-blocking PostgreSQL advisory-lock operation in short transactions, rolling back before each retry wait so contention does not park a pool connection. Let the caller's request or controller-task lifetime bound total waiting; do not add a helper-wide timeout or retry policy.
• Keep the specialized type in API-DB; do not add an API-Core forwarding wrapper or a generic transaction framework.

Acceptance criteria

• Competing transactions and processes for one site serialize.
• Same-process waiters queue before opening a transaction.
• Commit, rollback, holder cancellation, and waiter cancellation release both admission boundaries and leave the pool usable.
• Tests exercise the in-process gate and real PostgreSQL transactions.
• No external work is performed while the lock is held.
• No broad call-site sweep lands in this issue.

Out of scope

• A generic lock_site_mutation API or transaction framework.
• Full-site snapshots or overlap evaluation.
• Controller contraction/deletion paths.
• WorkLockManager or a new coordination service.

Dependencies

• Blocked by: None.
• Enables: The three admission-adoption issues under Enforce overlap eligibility and route-consumer safety atomically #3890.
• Parallel work: Renderer direction, overlap configuration, and force-delete fencing.

Reference implementation and test corpus: #4940. Part of #3890 and #3883.