fix(labs): strict numeric parsing, atomic confirm guard, test integrity

- normalize.ts num(): parseFloat truncated at the first comma, so "1,200"
  silently became 1 (1000x error) and "5,5" became 5. Now strictly matches
  either US thousands-grouping or a plain number spanning the whole string;
  anything else (incl. ambiguous "5,5") returns null instead of a wrong value.
- labs.ts confirm handler: the pending-status check ran before the request
  body was read, so two concurrent confirms could both pass it and
  double-insert. Added a guarded UPDATE ... WHERE status = 'pending' as the
  first statement inside the existing synchronous transaction; zero rows
  affected throws and the route returns 409, with the fast-path check kept
  for the common case.
- Added missing `await` on two rejects.toThrow assertions (llm.test.ts,
  extract.test.ts) that were previously resolving before the assertion
  settled.
- Bumped the 11th-failed-login rate-limit test to a 30s timeout — 10
  sequential argon2id verifies can exceed bun:test's 5s default under load.

server/test/normalize.test.ts

@@ -61,4 +61,21 @@ describe("normalizeMarker", () => {
     const n = normalizeMarker({ name: "DHEA-S", value: "250", unit: "ug/dL" });
     expect(n.valueCanonical).toBeCloseTo(6.78, 1); // 250 * 0.02713
   });
+  test("thousands-grouped value parses as 1200, not 1 (parseFloat truncation bug)", () => {
+    const n = normalizeMarker({ name: "Vitamin B12", value: "1,200", unit: "pg/mL" });
+    expect(n.valueNum).toBe(1200);
+    expect(n.analyteKey).toBe("vitamin_b12");
+    expect(n.valueCanonical).toBeCloseTo(885.35, 1);
+    expect(n.canonicalUnit).toBe("pmol/L");
+  });
+  test("ambiguous European-decimal-looking value is left unmapped, not silently wrong", () => {
+    const n = normalizeMarker({ name: "Glucose", value: "5,5", unit: "mg/dL" });
+    expect(n.valueNum).toBeNull();
+    expect(n.valueCanonical).toBeNull();
+    expect(n.value).toBe("5,5"); // raw value preserved
+  });
+  test("comparator value still parses after strict-parsing rewrite", () => {
+    const n = normalizeMarker({ name: "hs-CRP", value: "<0.3", unit: "mg/L" });
+    expect(n.valueNum).toBeCloseTo(0.3);
+  });
 });