fix(pcat-auth): cap concurrent captures at JWT_SITES.length, not 3

Concurrent captures are bound by how many distinct partner sites we can
drive in parallel — each capture needs its own site so they don't collide
on the synchronous siteIndex round-robin. Ports are effectively unlimited
(10000-10999) and Playwright contexts are isolated, so the previous
arbitrary cap of 3 left headroom on the table when the pool is cold and
N>3 user clicks race in at once.

Tying the cap to JWT_SITES.length also means future site additions or
removals auto-adjust the ceiling.

apps/api/src/integrations/parts-catalogs/parts-catalogs-auth.service.ts

@@ -103,10 +103,13 @@ export class PartsCatalogsAuthService implements OnModuleInit, OnModuleDestroy {
 
   private browser: Browser | null = null;
   private launching: Promise<void> | null = null;
-  // 3 concurrent captures: Playwright contexts are isolated, the synchronous
-  // site/port allocation hands out distinct values per call, and concurrent
-  // user clicks that all miss the pool no longer serialize behind one capture.
-  private readonly semaphore = new Semaphore(3);
+  // Concurrent captures capped at JWT_SITES.length — the real bottleneck is
+  // how many distinct partner sites we can drive in parallel (one capture per
+  // site, since each site = a different IP / cookie origin). Ports are
+  // ~unlimited (10000-10999) and Playwright contexts are isolated; the
+  // synchronous siteIndex round-robin hands each concurrent capture a
+  // different site so they don't collide.
+  private readonly semaphore = new Semaphore(JWT_SITES.length);
 
   // Pool state
   private pool: JwtSlot[] = [];