fix(traffic): support busybox flock and stop failing open on lock failure

[rvalitov]

Problem

busybox ships a flock applet that has no -w option. Because it installs a flock symlink to /bin/busybox, command -v flock succeeds on Alpine — so the "flock is unavailable, skip locking" guards never fired, and it was the lock call itself that failed:

$ flock -w 5 9
flock: unrecognized option: w
$ flock -n 9          # -n IS supported

Five call sites pass -w 5. Three aborted with "Could not acquire traffic lock", making all of these impossible on Alpine:

• secret_reset_traffic — secret reset-traffic, and monthly quota resets (which call it with output discarded, so they failed silently)
• run_traffic_reset_global — global traffic reset
• save_replication — replication config was never saved

The other two were worse: they had no guard at all and matched || { exec 9>&-; return 0; }, so they reported success while writing nothing.

• flush_traffic_to_disk — counters silently discarded before stop/restart
• save_traffic — the Telegram daemon persisted no traffic at all, with no error anywhere

Fix

Probe for -w support once, and fall back to flock -n, which busybox does support. The lock is still taken; only the 5-second grace period is lost. On a host with no flock at all, behaviour is unchanged (proceed unlocked).

_lock_fd centralises all five sites, and the two fail-open paths now return non-zero instead of 0. Those two write to stderr rather than log_error because save_traffic also runs inside the generated daemon script, which has no logging helpers.

Testing

New tests/test_flock_portability.sh places a busybox-style flock on PATH, so the regression is caught on every platform rather than only on Alpine. It also pins the fail-closed behaviour.

Verified on Alpine 3.20: tests/test_traffic_reset.sh goes from 21 failures to 0. No test result changes on Debian 12, Ubuntu 22.04/24.04 or Fedora 41.