feat(transform-eval): per-org concurrency bound for vector subprocess (SC-2)

[TerrifiedBug]

SC-2 — per-org fairness for the heavy vector subprocess

evaluateVrl() (src/server/services/transform-eval.ts) spawns a vector subprocess (execFile, 15s) on every VRL eval. There was no cross-request per-org bound, so one tenant issuing many concurrent evals (live-tap iteration, cost what-if, unit-test "run all", the AI propose auto-fix loop) could spawn unbounded vector processes and starve the shared host.

Change

1. New src/lib/org-concurrency.ts — withOrgConcurrencyLimit(orgId, key, max, fn): an in-process per-(org, key) async semaphore. Caps concurrent fn executions for the pair, queues the rest FIFO, hands a freed slot directly to the next waiter, and always releases on success/throw. A missing/empty orgId collapses to a shared "global" bucket; idle buckets are pruned so the Map tracks live concurrency, not historical org count. Single-process (per Node worker) — fairness within a host, not a distributed limiter.
2. evaluateVrl(source, events, opts?) gains optional opts.orgId. When set, the subprocess spawn runs under withOrgConcurrencyLimit(orgId, "vector-eval", 4). The no-op fast path (empty program/input) never takes a slot, and behavior is identical when orgId is omitted (backward-compatible).
3. Call sites threaded with { orgId: ctx/input.organizationId }:
   • vrl.ts — runUnitTests, runPipelineUnitTests (via runTestsAgainstSource), testAgainstCapture
   • tap-capture.ts — testTransform (live-tap)
   • cost-recommendation-procedures.ts — simulateTransform (cost what-if)
   • proposed-change.ts — VRL validate + bounded auto-fix loop

Tests

src/lib/__tests__/org-concurrency.test.ts uses controllable deferred barriers (no real timers): caps concurrency (max=2, 5 tasks → peak 2), drains FIFO in order, isolates different orgs and different keys, falls back empty/whitespace orgId → shared "global" bucket, and releases the slot on throw.

• vitest run src/lib/__tests__/org-concurrency.test.ts src/server/services/__tests__/transform-eval.test.ts → 15 passed
• Affected suites (tap-capture, vrl-unit-test, vrl-pipeline-unit-test, cost-recommendation-simulate, proposed-change) → 60 passed (updated the evaluateVrl arg assertions to the new 3-arg form)
• tsc --noEmit filtered to changed files: clean — only the known worktree-local @clickhouse/client module-resolution error remains (unrelated to this change).

Notes

• No Prisma migration.
• Editor / agent / cloud-UI paths aren't locally or visually verifiable here; unit tests + types are the bar.