fix: address PR review findings from bot analysis

- Fix incorrect docstring method names in get_item (set_quantity ->
  increase_quantity, decrease_quantity, try_decrease_quantity)
- Add asyncio.Lock to AsyncJWKSFetcher._fetch_jwks to deduplicate
  concurrent JWKS fetches on cold/expired cache
- Add threading.Lock to SyncJWKSFetcher._fetch_jwks for same reason
- Add threading.Lock to _get_or_create_memory_store to prevent
  race condition in token store registry
- Fix README clone URL to point to upstream repo
- Fix E2E test SyncJWKSFetcher constructor to use correct signature
  (jwks_url + http_client instead of project_id + base_url)

sdks/implementations/python/tests/test_e2e.py

@@ -302,12 +302,15 @@ class TestAuthenticateRequestE2E:
     """
 
     def test_unauthenticated_request_without_token(self, app: StackServerApp) -> None:
+        import httpx as httpx_client
+
         from stack_auth._auth import sync_authenticate_request
         from stack_auth._jwt import SyncJWKSFetcher
 
+        jwks_url = f"{BASE_URL}/api/v1/projects/{PROJECT_ID}/.well-known/jwks.json"
         fetcher = SyncJWKSFetcher(
-            project_id=PROJECT_ID,
-            base_url=BASE_URL,
+            jwks_url=jwks_url,
+            http_client=httpx_client.Client(),
         )
 
         class FakeRequest:
@@ -320,12 +323,15 @@ class TestAuthenticateRequestE2E:
         assert result.status == "unauthenticated"
 
     def test_invalid_token_returns_unauthenticated(self, app: StackServerApp) -> None:
+        import httpx as httpx_client
+
         from stack_auth._auth import sync_authenticate_request
         from stack_auth._jwt import SyncJWKSFetcher
 
+        jwks_url = f"{BASE_URL}/api/v1/projects/{PROJECT_ID}/.well-known/jwks.json"
         fetcher = SyncJWKSFetcher(
-            project_id=PROJECT_ID,
-            base_url=BASE_URL,
+            jwks_url=jwks_url,
+            http_client=httpx_client.Client(),
         )
 
         class FakeRequest: