#558 [API/Race] tenant_apps.py TOCTOU in upgrade_app

File: api/blueprints/v1/tenant_apps.py:442-513. Multiple sequential SELECTs (current installation, target version) then UPDATE. Concurrent upgrades could result in unexpected states. FIX: Use SELECT FOR UPDATE on installation row.