Unauthenticated promotion-limit bypass via non-atomic usage update

Race condition in MedusaJS Medusa 2.12.2 and earlier allows remote attackers to bypass limited-use promotions during checkout. The promotion module's registerUsage() function reads the current use count, checks it against the configured limit, and later writes the increment without an atomic database operation or lock. Unauthenticated access to cart creation and checkout is sufficient; concurrent requests can redeem one code beyond its intended limit and cause merchant financial loss.