fix: replace unsafe Arc mutation in PUT /api/budget with RwLock

[rager306]

Summary

PUT /api/budget currently casts &Arc<AppState> to *mut KernelConfig and mutates budget fields through a raw pointer:

// routes.rs ~line 5282
let config_ptr = &state.kernel.config as *const KernelConfig
    as *mut KernelConfig;
unsafe {
    (*config_ptr).budget.max_hourly_usd = v;
    // ...
}

This is unsound: AppState is wrapped in Arc and shared across all Tokio worker threads. Two concurrent PUT /api/budget requests produce a data race on the same memory. The Rust compiler gives no guarantees for this pattern — the optimizer can reorder or elide the stores.

Fix

Add pub budget_config: Arc<tokio::sync::RwLock<BudgetConfig>> to AppState, initialized from kernel.config.budget at startup. Readers use .read().await, writer uses .write().await. Zero unsafe code in the budget update path.

Testing

• cargo build -p openfang-api passes
• No new unsafe blocks introduced
• Concurrent budget updates are now serialized via RwLock