fix(playlists): every sync path locks the list before its items, and holds it to the write

The mirror refresh re-ingested inside its row lock, and that ingest's commit let go of the lock
before the replace: a remove made then was undone and the list read as synced. Push, re-pull and a
delete touched items before the list row, a deadlock beside the playlist-first route edits. A push
now re-plans from the items under the lock and derives dirty after its YouTube writes.
lock_playlists moves to the sync package. Tests pin both ids of a move's lock and the claim's
own connection.

backend/app/routes/playlists.py

@@ -14,6 +14,7 @@ from app.db import get_db
 from app.feedquery import feed_columns, serialize
 from app.models import Channel, Playlist, PlaylistItem, User, Video, VideoState
 from app.sync.playlists import (
+    lock_playlists,
     merge_playlist,
     plan_merge,
     recompute_dirty,
@@ -79,25 +80,11 @@ def _next_playlist_position(db: Session, user_id: int) -> int:
     )
 
 
-def _lock_playlists(db: Session, *playlist_ids: int) -> None:
-    """Row-lock playlists before touching their items, several in id order. Every item write takes
-    the PLAYLIST first: a writer that locked an item row first and the playlist second (a remove
-    beside a reorder) deadlocks against one that went the other way, and the loser is a 500. The
-    rows are re-read, so `dirty` and the sync baseline are the ones a finished sync committed."""
-    db.scalars(
-        select(Playlist)
-        .where(Playlist.id.in_(sorted(set(playlist_ids))))
-        .order_by(Playlist.id)
-        .with_for_update()
-        .execution_options(populate_existing=True)
-    ).all()  # consumed: rows fetched are what refreshes the loaded objects
-
-
 def _next_item_position(db: Session, playlist_id: int) -> int:
     """Append position for a new item at the end of a playlist. Locks the playlist row first: two
     adds (two tabs, the rail and the page) otherwise both read the same max and land on one
     position, and the list's order between them is then arbitrary."""
-    _lock_playlists(db, playlist_id)
+    lock_playlists(db, playlist_id)
     return (
         db.scalar(
             select(func.coalesce(func.max(PlaylistItem.position), -1)).where(
@@ -113,7 +100,7 @@ def _add_item(db: Session, pl: Playlist, video_id: str, *, mark_dirty: bool) ->
     was added. `mark_dirty` recomputes the YouTube-sync dirty flag (skip for Watch later).
     Locked BEFORE the presence check: two adds of one video both saw "absent" and the second one's
     insert hit uq_playlist_video as a 500."""
-    _lock_playlists(db, pl.id)
+    lock_playlists(db, pl.id)
     exists = db.scalar(
         select(PlaylistItem).where(
             PlaylistItem.playlist_id == pl.id, PlaylistItem.video_id == video_id
@@ -134,7 +121,7 @@ def _add_item(db: Session, pl: Playlist, video_id: str, *, mark_dirty: bool) ->
 def _remove_item(db: Session, pl: Playlist, video_id: str, *, mark_dirty: bool) -> bool:
     """Remove a video from a playlist if present (idempotent). Returns whether it was removed.
     `mark_dirty` recomputes the YouTube-sync dirty flag (skip for Watch later)."""
-    _lock_playlists(db, pl.id)
+    lock_playlists(db, pl.id)
     item = db.scalar(
         select(PlaylistItem).where(
             PlaylistItem.playlist_id == pl.id, PlaylistItem.video_id == video_id
@@ -541,6 +528,8 @@ def delete_playlist(
                     yt.delete_playlist(pl.yt_playlist_id)
         except YouTubeError as exc:
             raise youtube_refusal(exc)
+    # The playlist first, as every item write: the cascade deletes the items before the list row.
+    lock_playlists(db, pl.id)
     db.delete(pl)  # items cascade
     db.commit()
     return {"deleted": playlist_id}
@@ -625,7 +614,7 @@ def move_item(
             status_code=400, detail={"code": "playlist_move", "reason": "same_playlist"}
         )
     # Both lists, in id order: a move A→B beside a move B→A would otherwise lock crosswise.
-    _lock_playlists(db, src.id, dst.id)
+    lock_playlists(db, src.id, dst.id)
     item = db.scalar(
         select(PlaylistItem).where(
             PlaylistItem.playlist_id == src.id, PlaylistItem.video_id == video_id