fix(duplicate-detection): reap expired locks on sweep and cap activeLocks capacity (closes #928)

[mopxam-art]

Why

activeLocks in src/lib/duplicate-detection.ts retained locks for project IDs that were never updated again. Entries were previously only deleted on markCompleted, markFailed, or when the same project ID invoked tryBeginUpdate after TTL expiry. Furthermore, the map had no size bound, leading to unbounded memory retention over long service runtimes.

What

• Implemented opportunistic expiration sweeping (sweepExpiredLocks) in src/lib/duplicate-detection.ts aligned with the precedent in idempotency.ts. Abandoned locks for unvisited project IDs are purged whenever new updates are initiated.
• Bounded activeLocks to DEFAULT_MAX_ACTIVE_LOCKS = 10_000 with FIFO eviction of the oldest lock when capacity is reached.
• Added configuration and query helpers: setMaxActiveLocks, getMaxActiveLocks, getActiveLocksCount, and sweepExpiredLocks.
• Restored resetLocks to clear all entries and reset TTL and capacity thresholds to defaults.
• Exported ERROR_RATE_LIMIT_WINDOW_MS in src/lib/error-limiter.ts to satisfy test expectations.

Verified

• Added comprehensive unit tests in src/__tests__/duplicate-detection.test.ts (117 passing) covering TTL thresholds, bounded capacity, FIFO eviction, opportunistic sweep of abandoned locks, and high-frequency stress runs.
• All unit test suites pass cleanly (npm test).
• TypeScript typecheck (npx tsc --noEmit) and linter (npm run lint) pass with 0 errors.
• Production build (npm run build) compiles cleanly.

Payout coordinate:
USDC (EVM / Base / Arbitrum / ERC20): 0x387c064ccf729a4846b62e95dc6b70e4d4c41e73

Closes #928