fix(revoke): let only one request flip an Azure purchase to in-flight, so concurrent first revokes can't post two Returns #1518

Problem

Two first-time revoke requests for the same Azure purchase can both pass FlipPurchaseRevocationInFlight. Since #1516 it refuses revoked rows, but it still lets a row that is already in flight be flipped again. So both requests post a Return. Azure rejects the second one, and that request's error handling clears the in-flight flag (internal/api/handler_purchases_revoke.go). If the first request then also fails to record the revocation after all its retries, the row ends up neither revoked nor flagged as in flight. The reconciliation sweep never picks it up, even though the user was told the refund is being reconciled.

This was there before #1516; that PR leaves it to the owner.

Proposal

Let only one request set the flag: flip with AND revocation_in_flight = false, and answer "in flight" to the request that loses. ClearRevocationInFlight should only clear the flag for the request that set it, or at least never clear it on a row that another request owns.

Acceptance criteria

• A real-Postgres race test where two first-time revokes run at once: exactly one posts a Return, and the other answers "in flight".
• A rejected Return can't clear a flag that another request set.

Refs #316, #1516