Fix run-scoped execution lifecycle events

[JustinPerea]

What changed

• add optional runId correlation to graph, node, concurrent Create, and Cinema-shot requests
• propagate the run through backend execution events, including handler-emitted progress and stream events via task-local context
• only allow matching lifecycle events to clear the active Canvas lock or close its run-history record
• preserve legacy callers whose events do not include a run id
• add regression coverage for overlapping Create and Canvas runs, stale completions, request payloads, validation events, and task-local propagation

Why

A concurrent Create generation could emit graphComplete while a Canvas run was active. The frontend previously cleared the global isExecuting lock unconditionally, allowing a second Canvas run to overlap and closing the wrong lifecycle state.

Validation

• backend: 1,167 tests passed, with two existing AsyncMock warnings
• frontend: 397 tests passed
• frontend lint passed
• TypeScript and production build passed
• git diff --check passed
• staged credential scan passed
• no paid provider calls ran

Existing build warnings remain for lottie-web direct eval and large chunks.