fix(api): hydrate planner from DB exactly once on first GET, not on every read

get_config was calling planner.apply_payload on every GET request, racing
concurrent reads on module-level globals. Added a _hydrated flag + lock
so DB hydration runs at most once per process lifetime; put_config marks
it done too. Test fixture resets the flag between tests.

tests/api/realism/test_config_api.py

@@ -12,8 +12,11 @@ from decnet.realism import planner
 
 @pytest.fixture(autouse=True)
 def _reset_planner():
+    import decnet.web.router.realism.api_config as _api_config
+    _api_config._hydrated = False
     yield
     planner.reset_to_defaults()
+    _api_config._hydrated = False
 
 
 @pytest.mark.asyncio