Repository:
- Add _lock to InMemoryMunicipalityProfileRepository; make duplicate-JCode
  check + insert atomic in CreateAsync (TOCTOU fix) and wrap UpdateAsync
  read-modify-write in lock (lost-update fix)
- Normalize JCode before passing to ILegacyLinkValidator so validation and
  storage use the same form (was: raw input validated, ToUpperInvariant stored)
- UpdateAsync returns ProfileNotFound (new factory on MunicipalityProfileSaveResult)
  so controller can distinguish 404 from 422

Controller:
- Null-guard post-save/update GetByIdAsync result instead of bang-deref
- Return 404 (not 422) when update target profile does not exist
- GET /api/municipalities/jurisdictions accepted as in-scope extension

Data access:
- FromJsonSeedFile: catch(Exception ex) with Console.Error.WriteLine;
  DistinctBy(JCode) before projection to suppress duplicates in seed file
- 422 body shape mismatch: problem.error ?? 'Validation failed.' fallback
  in createMunicipalityProfile and updateMunicipalityProfile

Frontend:
- Split Promise.all into independent profile + jurisdiction loads so a
  jurisdiction failure does not suppress the profile table
- Add jurisdictionsLoadError state; disable "New" button and show warning
  alert when jurisdictions are unavailable

Tests:
- Override ILegacyDataAccess in AuthIntegrationTestFactory with hardcoded
  defaults, isolating integration tests from the development seed file
- Add wrong-role 403, jurisdiction endpoint 401, update-not-found 404,
  and AC#3 audit assertion tests (create + update) to controller suite
- Add fetchAvailableJurisdictions contract tests (success + failure)
- Story 1.10 marked done; sprint-status synced