fix(storage): surface a friendly error on a racing connection create

[pedrofrxncx]

Source: bug found while auditing apps/api/src/storage/connection.ts for races/error handling per the storage-layer focus area.

Why a maintainer wants this: ConnectionStorage.create() does a check-then-insert (select for an existing row, insert if none found) that is TOCTOU-racy — two concurrent create() calls for the same id can both pass the existence check, then both attempt the insert. The primary-key constraint on connections.id rejects the loser, but create() let that raw Postgres driver error (duplicate key value violates unique constraint ...) escape unhandled, instead of the friendly "Connection ID already exists" error that the sibling createNew() method already gives for the exact same race (see its existing test at line 90-115 of the integration test file). create() is a live path — reports/setup.ts, monitor-run-start.ts, plugin-config-update.ts, and deco-sites.ts all call it with a deterministic, org-scoped id — so a double-submit or a racing webhook hits this today and a caller gets an opaque driver error instead of a message it can branch on.

Failure scenario: two requests concurrently call storage.connections.create({ id: "conn_x", ... }) for the same deterministic id (e.g. two overlapping calls to reports/setup.ts for the same org). Both pass the existence check, one insert wins, the other's insert throws a raw duplicate key value violates unique constraint "connections_pkey" error instead of "Connection ID already exists".

Fix: wrap the insert in a try/catch and rethrow the same friendly error createNew() already uses for this exact race — one code path, no behavior change on the non-racing path (same insert, same returned row).

Regression test: added apps/api/src/storage/connection.integration.test.ts — fires two concurrent create() calls for the same id and asserts any rejection carries the friendly message, not a raw driver error.

Command a reviewer runs to confirm: bun test apps/api/src/storage/connection.integration.test.ts (needs Postgres — same as every other test in that file; not runnable in this bot's sandbox).

Locally verified: bun run fmt, cd apps/api && bunx tsc --noEmit (clean), bunx oxlint on both changed files (0 warnings/errors). The integration test itself needs a real Postgres instance, which isn't available in this sandbox — full CI validates it.

---

Summary by cubic

Surfaces a friendly "Connection ID already exists" error when concurrent ConnectionStorage.create() calls race on the same id, instead of leaking the raw Postgres duplicate-key error. This matches createNew() and leaves non-racing behavior unchanged.

Review notes

• Wraps the insert in try/catch; maps duplicate-key/unique-constraint errors to the friendly message, otherwise rethrows the original error.
• Adds an integration test that runs two concurrent create() calls and asserts any rejection carries the friendly message.
• Improves error handling for current callers that use deterministic ids (double-submit/webhook races); no schema or API changes.

^{Written for commit c089212. Summary will update on new commits.}