[lhk0504]

Fixes #1646

Proposed Changes

• Acquire the question, answer, or comment's write lock before reading vote totals, then count and save within the same transaction. Concurrent refreshes for the same object are serialized, preventing a delayed request from overwriting a newer total.
• Count active upvotes and downvotes in one grouped query and use that result for both the stored score and the returned counts. Propagate configuration/query errors and roll back failed refreshes. Resolve activity types before opening the transaction to avoid requiring a second SQLite connection; comments remain upvote-only.
• Add deterministic two-connection regression tests for upvotes, cancellations, downvotes, and vote-direction changes, plus active-vote filtering, negative/zero totals, and error handling. The controlled stale-write regression fails against the original implementation and passes with this fix.

The lock is acquired with a no-op update that preserves the score and update timestamp. It is held through the count and final update, so refreshes on the same object wait for each other. SQLite uses its database write lock; PostgreSQL/MySQL use the target row's write lock.

Validation

• go test ./internal/repo/activity ./internal/repo/repo_test ./internal/service/content -count=1
• go test -race ./internal/repo/activity -count=1 -timeout 90s
• go build ./...
• go vet ./...
• golangci-lint run ./internal/repo/activity/... (0 issues)
• git diff --check

The committed tests use SQLite. The same regression tests also passed against a temporary local PostgreSQL 14.2 instance using a test-fixture adapter supplied through Go's -overlay option; that adapter is not part of this change. MySQL/MariaDB have not been tested.

Related: #1650 proposes another approach to the same issue.