fix: address concurrency races in stats aggregation

[mjfelis]

Summary

Fixes several concurrency / correctness issues found during a review of the stat ingest + aggregation path. Scoped to the low-risk, high-value set; compiles cleanly (./mvnw clean compile).

Fixes

1. Lost-update race in StatBuilderService.getStat (data loss)

When two threads created the same statClass/entity/granularity/ts bucket concurrently, the race loser returned its own orphaned Stat instance (never put in the cache) instead of the winner already in the map. Its increments were silently dropped at flush. Also the } { block was an unconditional block, not an else, so the "Not CREATED" warning always fired. Now the loser reuses the cached raceStat.

2. Startup ordering NPE race in StatController.onStart

setStartedService(true) ran synchronously while statService.init(tz) (which allocates the static stats map) ran asynchronously inside startPurgeTask(). A consumer could observe startedService==true and call getStat() while stats was still null → NPE. onStart now resolves the timezone and calls init(tz) before setStartedService(true). init() is now synchronized and idempotent (only allocates if null) so the later call from the purge task is harmless.

3. NumberFormat thread-safety in StatReaderService

NumberFormat is not thread-safe and was a shared static used by concurrent /stats/view and /stats/compare requests. Replaced with a ThreadLocal<NumberFormat>.

4. Missing volatile on cross-thread lifecycle flags

startedService (StatBuilderService), startedPurge and finished (StatController) are written/read across threads outside synchronized blocks; finished is spun on during shutdown. Marked volatile to guarantee visibility (fixes a potential shutdown hang).

Not included (tracked for a separate, more careful change)

• Shared EntityManager used across consumer/flush/reader threads.
• Flush vs increment lock-identity desync via removeLockObj.
• flushStats(statClass, entityId) not holding the per-stat lock.
• Null stat NPE swallowed in flushStats.
• StatServerResource.computeGranularity dereferencing from/to before the null checks (returns 500 instead of 400).

Test plan

• ./mvnw clean compile passes.
• No behavior change to the public REST contract.