First-user registration race can create multiple users

Initial registration checks user count, then inserts the first user without a transaction or lock.

Affected area:

• apps/api/src/services/authService.ts

Impact:

• Two concurrent first-registration requests can both pass the count check and create multiple users.

Expected:

• Only one initial user can be created under concurrent requests.

Acceptance criteria:

• Protect first-user creation with a transaction/advisory lock or DB-backed singleton guard.
• Add a concurrency test that proves only one first user is created.