[client] Keep a withdrawal from discarding a payload being delivered

Completing an offer and delivering it ran with no lock held across the two,
while a sender could send DELETE at any point and withdraw ran spool.Remove
without looking at the offer's state. A withdrawal landing in that window
deleted the staged bytes out from under the copy: delivery failed with
"open spooled file: no such file or directory", the transfer was recorded as
failed, and the payload was gone although the sender had seen its upload
succeed.

A completed offer is no longer withdrawable, and publishing or discarding one
offer's payloads now serialises on a per-offer lock the two sinks share, so a
removal waits for a delivery in flight instead of racing it. deliver() drops
the spool as its last step and reaches it through removeLocked, since the
lock it would otherwise retake is the one it already holds.

client/internal/filedrop/spool.go

@@ -13,6 +13,7 @@ import (
 
 // Spool stages incoming payloads in an app-private directory.
 type Spool struct {
+	offerLocks
 	root string
 }
 
@@ -97,6 +98,8 @@ func (s *Spool) Write(id OfferID, index int, _ string, offset int64, r io.Reader
 // Deliver moves an offer's staged payloads into destDir under their announced
 // names and returns where each one landed.
 func (s *Spool) Deliver(offer Offer, destDir string) ([]string, error) {
+	defer s.lock(offer.ID)()
+
 	return deliver(s, offer, destDir)
 }
 
@@ -107,6 +110,15 @@ func (s *Spool) Path(id OfferID, index int) string {
 
 // Remove deletes an offer's staged payloads.
 func (s *Spool) Remove(id OfferID) {
+	defer s.lock(id)()
+
+	s.removeLocked(id)
+}
+
+// removeLocked discards one offer's payloads without taking its lock, for a
+// caller that already holds it. Deliver removes the spool as its last step and
+// would otherwise block on itself.
+func (s *Spool) removeLocked(id OfferID) {
 	if err := os.RemoveAll(s.OfferDir(id)); err != nil {
 		log.Debugf("remove spool dir: %v", err)
 	}