Discount reuse via unsynchronized promo-code usage checks

Race condition in alf.io before 2.0-M5 allows remote attackers to exceed an organizer-set promo code limit through concurrent reservations. The reservation flow checks promo-code validity twice without serializing the usage-count check and reservation write, so synchronized requests can each observe remaining capacity before either consumes it. No account or user interaction is required; successful exploitation applies the same limited discount to multiple registrations, causing financial loss rather than code execution or data disclosure.