Add linux/386 build target for iSH on iOS

[badoriie]

Background

iSH is a free iOS app that runs an Alpine Linux x86 environment on iPhone using a user-mode x86 emulator. It lets volunteers run server software on a phone they already own — no VPS required.

Since the Conduit iOS app is not currently on the App Store, iSH is a practical path for iOS users to contribute as a Conduit node. I tested this end-to-end on my own iPhone and it works.

What this PR does

1. linux/386 CLI build target (cli/)

Adds build-linux-386 to the Makefile and wires it into build-all, build-all-embedded, and the release workflow so conduit-linux-386 appears in every release.

Three build-time optimisations specific to iSH:

Flag	Reason
GO386=softfloat	iSH emulates SSE2 in software. Softfloat makes Go emit plain integer instructions instead of SSE2 for float ops, reducing emulation overhead.
netgo	Uses Go's pure-Go DNS resolver. Avoids glibc DNS syscall overhead under iSH's emulation layer.
GOMAXPROCS=1 (runtime, cmd/ish_linux_386.go)	iSH's %gs thread-local storage emulation is unreliable in signal handler context. With multiple Ps, Go sends SIGURG to preempt goroutines across OS threads, which triggers a fatal: bad g in signal handler crash on startup. Limiting to one P keeps all goroutines on a single scheduler, preventing the cross-thread SIGURG delivery that causes the crash.

The binary is statically linked (CGO_ENABLED=0) so it runs on iSH's Alpine/musl userland without any extra dependencies or setup beyond chmod +x.

2. Concurrent session refresh race condition fix (src/hosted/sessionQueries.ts)

Unrelated to iSH, but found while working in this area.

When a session is about to expire, useHostedAccountProfileQuery and useHostedConduitsQuery both mount and independently call withHostedSessionRecovery → ensureHostedSession → refreshHostedSession. Because they run concurrently before either has written the refreshed token back to the cache, they both see the expiring token and both call sessionClient.refresh() — producing redundant parallel refresh requests.

Fixed by coalescing concurrent calls per queryClient+baseUrl into a single in-flight promise using a WeakMap<QueryClient, Map<string, Promise<HostedSession>>>. All concurrent callers share the same request. WeakMap keying on queryClient gives each test instance an isolated map automatically, with no teardown needed.

Testing

iSH (iPhone):

apk add curl
curl -L -o conduit https://github.com/badoriie/conduit/releases/download/release-cli-2.1.5-beta.9/conduit-linux-386
chmod +x conduit
./conduit start --max-common-clients 2

Confirmed working — binary starts, announces, and relays traffic.

Session refresh fix:

npm run test

All 483 tests pass. The previously failing test (refreshes expiring sessions via session client) now correctly expects sessionClient.refresh to be called once.