TOCTOU: single-use identity can be served more than once (auto-login)

## Summary
`GET /identities/:id` (auto-login) does `getIdentity` (Redis GET) → validate → `deleteIdentity` (DEL) **non-atomically** (`src/ports/server/component.ts:1037-1140` + `src/ports/storage/component.ts:74-93`). Two concurrent requests with the same `identityId` both read the identity before either deletes it, so both return 200 with the identity — which contains the ephemeral session private key. The "already consumed" guard only applies after the delete completes.

## Impact
Anyone who intercepts/guesses the `identityId` (UUID in the URL) can have the single-use identity served 2+ times within the race window.

## Fix
Consume atomically: Redis `GETDEL` (6.2+) or `SET NX` lock, or gate the 200 response on the `DEL` having removed exactly one key (Redis DEL returns the count). Note: the cache layer is provided by external packages (`@dcl/core-commons`, `@dcl/redis-component`), so an atomic primitive likely needs to be added there.