Make concurrent database writes wait instead of failing (closes #253)

SQLite transactions started deferred, so two that both read and then
wrote could not both proceed, and SQLite refused the second at once with
"database is locked" without waiting. TestCreateUserRaceCondition hit
this now and then.

The database is now opened with _txlock=immediate, so each transaction
takes the write lock when it begins and a second one waits for it, and
with _busy_timeout=5000, so that wait lasts up to 5 seconds. The driver
already defaults to 5000; it is now stated in the code.

Model: opus-5-5

TODO.md

@@ -20,6 +20,10 @@ regress.
 
 # Completed Steps
 
+- 2026-10-01: Two database writes at the same moment no longer fail with
+  "database is locked": each transaction now takes the write lock when it begins
+  and waits up to 5 seconds for another writer to finish (#253).
+
 - 2026-10-01: The hint under the app page's environment variable editor now says
   changes take effect at the next deploy or rollback, in the page's warning
   style, instead of asking for a container restart, which keeps the old values

internal/database/database.go

@@ -137,8 +137,11 @@ func (d *Database) connect(ctx context.Context) error {
 		return fmt.Errorf("failed to create data directory: %w", err)
 	}
 
-	// Open database with WAL mode and foreign keys
+	// Open database with WAL mode and foreign keys. Transactions take the
-	dsn := dbPath + "?_journal_mode=WAL&_foreign_keys=on"
+	// write lock when they begin and wait up to 5s for another writer,
+	// instead of failing with "database is locked" when both write.
+	dsn := dbPath + "?_journal_mode=WAL&_foreign_keys=on" +
+		"&_txlock=immediate&_busy_timeout=5000"
 
 	database, err := sql.Open("sqlite3", dsn)
 	if err != nil {