Guard the archiver and notifier passes with a Postgres advisory lock

Both background loops run unconditionally on every instance with no
coordination between them, which the chart's replicas: 1 + strategy:
Recreate exists specifically to paper over: with more than one replica,
every one of them would sweep and deliver notifications independently,
and two overlapping during a rollout would both page for the same
incident.

Add withAdvisoryLock, which takes a Postgres advisory lock on a
dedicated connection and runs a pass only if it gets the lock,
otherwise skipping until the next tick. Wire StartArchiver and
StartNotifier through it with their own lock keys, so Sweep and
NotifySweep themselves are untouched and every existing test calling
them directly keeps working unchanged.

This also closes the notifier's double-delivery race in passing: two
replicas can no longer both be inside deliverPending at once, since
only one can hold notifierLockKey at a time.

Deliberately not addressed here, and still blocking a replica count
above 1: the in-memory login rate limiter, the unlocked migration
runner, and the new-incident-insert race on a webhook for a brand-new
groupKey. Noted in the updated chart comment.

Co-authored-by: Claude <noreply@anthropic.com>

charts/terdut-server/templates/deployment.yaml

@@ -11,8 +11,11 @@ spec:
     matchLabels:
       {{- include "terdut-server.selectorLabels" . | nindent 6 }}
   # Recreate, not RollingUpdate, even though the PVC that forced it is gone: the
-  # sweeper and the notifier are unsynchronised singletons, and two replicas
-  # overlapping during a rollout would both page for the same incident.
+  # sweeper and notifier now take a Postgres advisory lock for each pass, so two
+  # replicas overlapping during a rollout no longer both page for the same
+  # incident, but DB migrations and new-incident creation on first webhook are
+  # still unguarded — a second replica starting concurrently with the first can
+  # still race either of those.
   strategy:
     type: Recreate
   template: