fix(vault): clean orphaned assignments on deletion

[Gjusev]

What is this PR about?

Fixes orphaned Secret Vault assignment IDs when projects or environments are deleted. Cleanup now runs in the same database transaction as deletion, is scoped to the owning organization, and shares a transaction-scoped organization advisory lock with provider validation and writes before updating JSONB assignments. Existing orphaned data is sanitized in provider read responses without causing writes, so affected providers can be edited and saved again while strict assignment validation remains intact.

Checklist

• You created a dedicated branch based on the canary branch.
• You have read the suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request
• You have tested this PR in your local instance. If you have not tested it yet, please do so before submitting. This helps avoid wasting maintainers' time reviewing code that has not been verified by you.

Local verification used the documented Dokploy setup with a migrated PostgreSQL 16 database. I exercised the production services for both project and environment deletion, verified the stored JSONB assignments, injected legacy orphaned IDs, confirmed reads did not mutate storage, and successfully saved the sanitized provider. I also forced concurrent create/update requests to wait behind deletion, confirmed the wait in PostgreSQL pg_locks, and verified both rejected stale assignments after deletion committed.

Automated checks:

• pnpm exec biome check packages/server/src/services/vault-provider.ts packages/server/src/services/project.ts packages/server/src/services/environment.ts apps/dokploy/__test__/env/vault-orphaned-assignments.test.ts
• pnpm --filter=@dokploy/server typecheck
• pnpm --filter=dokploy typecheck
• pnpm --filter=dokploy test --run __test__/env/vault-orphaned-assignments.test.ts (8 passed)
• pnpm --filter=dokploy test --run __test__/env (154 passed)
• pnpm dokploy:build

I also ran the full test suite: 1,015 tests passed and 5 were skipped. The remaining 22 failures are in unrelated Windows/platform-dependent tests that invoke POSIX executables such as /bin/bash, sh, rm, and command, require symlink privileges, or expected a running Docker daemon. The new regression suite passed in that run.

Issues related (if applicable)

Closes #5425

Screenshots (if applicable)

Not applicable; this is a backend data-integrity fix.

Confidence Score: 4/5

The PR is not yet safe to merge because concurrent provider creation or updates can persist assignments to a resource after its deletion commits.

Summary

This PR cleans vault assignments as part of project and environment deletion transactions and sanitizes legacy orphaned assignments in provider read responses.

• Adds organization-scoped provider locking and transactional assignment cleanup.
• Filters invalid project and environment references from provider reads without writing.
• Adds regression coverage for cleanup, read sanitization, saving, and rollback.
• The cleanup remains vulnerable to concurrent provider creation or updates that validate before deletion and write afterward.

_{Reviews (1) ? Last reviewed commit: "fix(vault): clean assignments after reso..."}