feat: add syncutil mutex, test scaffolding, and server hardening

- Add syncutil package with deadlock-detecting mutex (build-tag switchable)
- Add main_test.go TestMain scaffolding across all server packages
- Harden concurrency in ws, admin, auth, and updater packages
- Update CI workflow, go.mod/sum, Cargo.lock, and root changelogen tooling

.github/workflows/ci.yml

@@ -35,6 +35,9 @@ jobs:
       - name: Run tests with race detection and coverage
         run: go test -race ./... -coverprofile=coverage.out -cover
 
+      - name: Run tests with deadlock detection
+        run: go test -tags deadlock -count=1 ./...
+
       - name: Upload Go coverage
         if: always()
         uses: actions/upload-artifact@v4