fix(appproxy): make circuit locks self-cleaning to prevent unbounded growth

[seedspirit]

Summary

• Replace CircuitManager._circuit_locks (plain dict) with a weakref.WeakValueDictionary so a per-circuit lock entry lives exactly as long as some coroutine holds or waits on it, then vanishes with its last user
• Fixes unbounded memory growth in Traefik mode: the 30s reconcile loop registers a lock entry for every live circuit, but entries were only removed by unload_circuits() in the same process — HA setups (reconcile consumed by instance A, unload run by instance B) and missed-unload circuits leaked entries forever
• Also fixes a mutual-exclusion race: the old explicit pop could orphan a lock that still had waiters, letting a subsequent caller create a second lock for the same circuit and enter the critical section concurrently

Test plan

• pants test tests/unit/appproxy/coordinator:: — all pass
• New tests: lock entry self-cleans after its last user; pending waiters keep the entry alive and concurrent callers converge on the same lock object
• mypy / ruff clean on changed files

🤖 Generated with Claude Code