fix(scheduler): move the single-run claim into _job (cover both paths)

The atomic claim added in trigger_job only covered the manual path; a scheduled
fire sets running via _job without claiming, so a manual trigger racing it could
still double-run, and the claim (set outside _job) could leak if _job threw
before its own cleanup. Move _claim_running to the top of _job — the one point
both the scheduled fire and the manual trigger pass through — and release it in
_job's finally, so exactly one run wins whichever path it comes from and a
failure can never wedge the job "running". trigger_job's _is_running check is now
just a best-effort fast answer for the UI. Unit-test _claim_running (and
is_messageable_user).

backend/tests/test_userscope.py

@@ -0,0 +1,23 @@
+"""is_messageable_user — the "real, active, non-suspended human" predicate reused by the messaging
+directory and the download share endpoints. A row must be non-demo AND active AND not-suspended."""
+from types import SimpleNamespace
+
+from app.userscope import is_messageable_user
+
+
+def _user(is_demo=False, is_active=True, is_suspended=False):
+    return SimpleNamespace(is_demo=is_demo, is_active=is_active, is_suspended=is_suspended)
+
+
+def test_a_real_active_human_is_messageable():
+    assert is_messageable_user(_user()) is True
+
+
+def test_none_is_not_messageable():
+    assert is_messageable_user(None) is False
+
+
+def test_demo_suspended_or_inactive_are_not_messageable():
+    assert is_messageable_user(_user(is_demo=True)) is False
+    assert is_messageable_user(_user(is_suspended=True)) is False
+    assert is_messageable_user(_user(is_active=False)) is False