fix(race): make make test-race pass across ./pkg/...

Add a test-race target and run test-unit over ./pkg/...

Production races:
- logger: guard Logger/errorTracker with an RWMutex
- security: copy UserContext for the async session-activity goroutine
  and track it with a WaitGroup

Test fixes:
- eventbroker, websocketspec: use atomics for state shared with workers
- security: wait for async activity updates before touching sqlmock
- mqttspec: build full HookContext, set SubscriptionID, pin the
  in-memory SQLite to one connection

Update the cross-cutting audit (X1) with status and findings.

pkg/websocketspec/hooks_test.go

@@ -3,6 +3,7 @@ package websocketspec
 import (
 	"context"
 	"errors"
+	"sync/atomic"
 	"testing"
 
 	"github.com/bitechdev/ResolveSpec/pkg/common"
@@ -519,9 +520,9 @@ func TestHookRegistry_ConcurrentExecution(t *testing.T) {
 	// This test verifies that concurrent hook executions don't cause race conditions
 	// Run with: go test -race
 
-	counter := 0
+	var counter atomic.Int64
 	hook := func(ctx *HookContext) error {
-		counter++
+		counter.Add(1)
 		return nil
 	}
 
@@ -543,5 +544,5 @@ func TestHookRegistry_ConcurrentExecution(t *testing.T) {
 		<-done
 	}
 
-	assert.Equal(t, 10, counter)
+	assert.Equal(t, int64(10), counter.Load())
 }