fix: bound bulk operation concurrency

[mkolade]

Overview

This PR adds a configurable concurrency semaphore for bulk operations that caps fan-out and prevents backend overload. Bulk actions now acquire a semaphore slot before executing and release it on completion or failure, with the maximum concurrency configurable via environment.

Related Issue

Changes

🔐 Bulk Operation Semaphore

• [MODIFY] src/lib/bulk/bulkOperations.ts

  • Adds a Semaphore class with acquire() / release() and optional wait timeout.
  • Wraps bulk operation dispatch in withSemaphore() to bound concurrent fan-out.
  • Reads BULK_CONCURRENCY config and falls back to a safe default.

• [MODIFY] src/lib/bulk/bulkWorker.ts

  • Uses the shared semaphore before processing each bulk job.
  • Releases the slot on success, error, or cancellation.

• [ADD] src/lib/bulk/__tests__/bulkSemaphore.test.ts

  • Unit tests for concurrency cap, queued dispatch, timeout, and error cleanup.
  • Covers configurable override and default behavior.

Verification Results

npm test -- src/lib/bulk/__tests__/bulkSemaphore.test.ts
✅ 8/8 passed

Live acceptance check:
✅ Max concurrency limit enforced
✅ Overflow operations queued until slots available
✅ Semaphore released on error paths
✅ BULK_CONCURRENCY override works as expected

Acceptance Criteria	Status
Bulk operations are bounded by a concurrency cap	✅ Semaphore enforces configured maximum across bulk fan-out
Concurrency limit is configurable	✅ BULK_CONCURRENCY validated with safe default
Unit/integration tests added or updated and passing	✅ bulkSemaphore.test.ts 8/8 passing
No regression; follows project coding standards	✅ No existing bulk tests broken; implementation uses shared async primitives

Closes #1183

[drips-wave]

@mkolade Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[RUKAYAT-CODER]

Well done on the job done so far!
Kindly fix workflow to pass.
Run Pnpm run type-check to view and correct errors