Serialize dashboard state read-modify-write with a lock

[k0shir0]

The server threads every request, but the mutating endpoints all do read-state, mutate, write-state with a Codex or network call in the middle - so two overlapping requests can have the slower one silently overwrite the faster one's update. Added an RLock held across the whole cycle in those handlers (reentrant because the agent path writes once mid-command and once at the end), with read_state and write_state also locking themselves so the plain state POST is covered too. Chat doesn't persist anything so it stays unlocked. The trade is that mutations now queue behind a long Codex call, which for a single-user dashboard beats losing an update. Compile-checked and hammered with an 8-thread read-modify-write smoke test locally.