fix(vouchers): make redemption atomic and reliable

[rmtshnik]

Summary

• create or update the secret before consuming the voucher
• call secret APIs with the correct argument layout and load existing secrets first
• serialize concurrent redemptions and save voucher state atomically
• make retries idempotent for the original owner while preventing voucher transfer
• recover partial states left by older releases
• isolate Bash parser variables from dynamic-scope side effects
• generate stable random voucher codes under pipefail
• add voucher regression coverage

Problem

Voucher redemption could mark a code as REDEEMED before the user account existed. An incorrect secret_add call and Bash dynamic scoping could also create missing accounts, overwrite caller state, or leave redeemed_by blank. Concurrent attempts were not serialized.

Verification

• verified the affected failure and recovery paths on a deployed test server
• confirmed new redemption, original-owner retry, owner recovery, and reuse rejection
• git diff --check passes

Local Bash tests could not be executed on the Windows development host.