Make movement dispatch atomic

[fabianwgl]

What changed

• atomically debit troops, settler resources, or reinforcement state with movement creation
• reject malformed, insufficient, and concurrent source debits without overdrawing
• use nested transactions/savepoints for callers that already own a transaction
• document the invariant and add rollback plus two-process concurrency regressions

Why

Movement producers mutated their source state before performing an unchecked movement insert. A failed insert could lose troops or resources, while concurrent requests could both debit the same source.

Impact

Manual sends, farm-list raids, settler dispatches, and reinforcement withdrawals now either commit their source mutation and movement together or leave the source untouched.

Validation

• rebuilt Docker Compose application and worker images
• PHP syntax checks for every changed PHP file
• PHPStan
• runtime regression suite, including forced insert rollback and concurrent dispatch
• formula golden regressions
• accelerated complete-round regression
• public-repository hygiene and mutation contract checks
• independent subagent review with no remaining findings