Bug: Race condition in concurrent state updates

[dewhush]

Concurrent state updates can overwrite each other because there's no mutex/lock around the update path.

Steps:

1. Send 2 simultaneous update requests
2. Final state reflects only last update
3. Data integrity lost

Fix: Add asyncio.Lock() or threading.Lock() around state mutations.

Priority: High
Labels: bug, concurrency, good-first-issue