test: fix async fixture isolation, add fuzz marks, parallelize with xdist

- Rebuild repo.engine and repo.session_factory per-test using unique
  in-memory SQLite URIs — fixes KeyError: 'access_token' caused by
  stale session_factory pointing at production DB
- Add @pytest.mark.fuzz to all Hypothesis and Schemathesis tests;
  default run excludes them (addopts = -m 'not fuzz')
- Add missing fuzz tests to bounty, fleet, histogram, and repository
- Use tmp_path for state file in patch_state_file/mock_state_file to
  eliminate file-path race conditions under xdist parallelism
- Set default addopts: -v -q -x -n logical (26 tests in ~7s)

tests/api/bounty/test_get_bounties.py

@@ -1,5 +1,7 @@
 import pytest
 import httpx
+from hypothesis import given, settings, strategies as st
+from ..conftest import _FUZZ_SETTINGS
 
 @pytest.mark.anyio
 async def test_add_and_get_bounty(client: httpx.AsyncClient, auth_token: str):
@@ -17,3 +19,24 @@ async def test_bounty_pagination(client: httpx.AsyncClient, auth_token: str):
     resp = await client.get("/api/v1/bounty?limit=1&offset=0", headers={"Authorization": f"Bearer {auth_token}"})
     assert resp.status_code == 200
     assert resp.json()["limit"] == 1
+
+@pytest.mark.fuzz
+@pytest.mark.anyio
+@settings(**_FUZZ_SETTINGS)
+@given(
+    limit=st.integers(min_value=-2000, max_value=5000),
+    offset=st.integers(min_value=-2000, max_value=5000),
+    bounty_type=st.one_of(st.none(), st.text(max_size=256)),
+    search=st.one_of(st.none(), st.text(max_size=2048)),
+)
+async def test_fuzz_bounty_query(client: httpx.AsyncClient, auth_token: str, limit: int, offset: int, bounty_type, search) -> None:
+    params = {"limit": limit, "offset": offset}
+    if bounty_type is not None:
+        params["bounty_type"] = bounty_type
+    if search is not None:
+        params["search"] = search
+    try:
+        resp = await client.get("/api/v1/bounty", params=params, headers={"Authorization": f"Bearer {auth_token}"})
+        assert resp.status_code in (200, 422)
+    except (UnicodeEncodeError,):
+        pass