fix: reject stale company profile and filter updates

tests/http-state.test.mjs

@@ -199,3 +199,21 @@ test('outbox review endpoint requires administrator and rejects unsupported or i
  assert.equal((await request('/api/admin/notify/outbox','POST',{id:'x',action:'skip',note:'short'},admin)).status,400);
  assert.equal((await request('/api/admin/notify/outbox','POST',{id:'missing',action:'skip',note:'Sağlayıcı kaydı kontrol edildi ve kapatılıyor.'},admin)).status,409);
 });
+
+test('profile and saved-filter writes require the loaded revision and reject concurrent overwrites',async()=>{
+ for(const anahtar of ['firma_profil','saved_filters']){
+  const deger=anahtar==='firma_profil'?{company:'QA başlangıç'}:[{id:'qa',name:'Başlangıç'}];
+  assert.equal((await request('/api/me/data','PUT',{anahtar,deger})).status,428);
+  const initial=await request('/api/me/data');const revision=initial.data.revisions[anahtar] ?? null;
+  const first=await request('/api/me/data','PUT',{anahtar,deger,revision});assert.equal(first.status,200);assert.match(first.data.revision,/^[a-f0-9]{64}$/);
+  const attempts=await Promise.all(Array.from({length:8},(_,i)=>request('/api/me/data','PUT',{anahtar,deger:anahtar==='firma_profil'?{company:'QA '+i}:[{id:'qa'+i}],revision:first.data.revision})));
+  assert.equal(attempts.filter(x=>x.status===200).length,1);
+  assert.equal(attempts.filter(x=>x.status===409&&x.data.kod==='VERSION_CONFLICT').length,7);
+  const after=await request('/api/me/data');assert.equal(after.data.revisions[anahtar],attempts.find(x=>x.status===200).data.revision);
+  const stale=await request('/api/me/data','PUT',{anahtar,deger,revision:first.data.revision});assert.equal(stale.status,409);
+  assert.deepEqual((await request('/api/me/data')).data.veri[anahtar],after.data.veri[anahtar]);
+  // A revision read under another owner cannot grant write access to this record.
+  const foreign=await request('/api/me/data','PUT',{anahtar,deger,revision:after.data.revisions[anahtar]},other);assert.equal(foreign.status,409);
+  assert.equal((await request('/api/me/data','PUT',{anahtar,deger,revision:null},other)).status,200);
+ }
+});