fix(auditdb): require matching anchor when refreshing an eid lease

[AkramBitar]

Fixes #2033

The problem

The lease row for an enrollment ID could be overwritten whenever owner = excluded.owner. owner is the replica ID — the same value for every audit on a node. So two concurrent audits on one node, for different transactions sharing an enrollment ID, both "acquired" it: the second overwrote the first's live row and AcquireLocks returned success to both. The mistake only surfaced later, at AssertLocksHeld just before the DB write.

The fix

Also require the anchor to match, so a lease is only refreshed by the same owner and the same transaction:

-- before
WHERE expires_at < NOW() OR owner = excluded.owner

-- after
WHERE expires_at < NOW() OR (owner = excluded.owner AND anchor = excluded.anchor)

Same owner, different anchor is now ordinary contention, retried until acquireDeadline. Expired leases stay claimable, so crash recovery is unchanged.

Tests

One query-shape test (no DB) and four against real Postgres: cross-anchor contention, same-anchor refresh, expired takeover, and four concurrent audits on one shared enrollment ID.

Against the old clause three fail — the concurrent one reporting all 4 audits as winners of the same lease. All pass with the fix under -race; go vet and golangci-lint clean.

[github-actions]

📊 Token Validation Benchmark

Comparison of this PR against the base branch. 🟢 improvement · 🔴 regression · ➖ within ±1.0% noise.

Variant	Benchmark	Params	Workers	TPS (base → PR)	Δ TPS
csp	BenchmarkAPIGRPC	f=1, nc=4, w=token-validation-service	4	151 → 150	➖ -0.2%
csp	BenchmarkLocalTokenValidation	out-tokens=2in-tokens=2	4	120 → 120	➖ +0.3%
ipa	BenchmarkAPIGRPC	f=1, nc=4, w=token-validation-service	4	91 → 91	➖ -0.0%
ipa	BenchmarkLocalTokenValidation	out-tokens=2in-tokens=2	4	76 → 76	➖ -0.1%

[Effi-S]

LGTM. @AkramBitar.
Notice you have a minor conflict