fix(android,ios): add thread safety to listener operations (#3152)

## Summary

- Android: wrap listener add/remove/iterate in `synchronized` blocks to
prevent `ConcurrentModificationException`
- iOS: add warning logs when `HybridRnIap` is deallocated during
purchase/error listener callbacks for better diagnostics

## Changes

### Android (`HybridRnIap.kt`)
- `addPurchaseUpdatedListener`, `removePurchaseUpdatedListener`,
`addPurchaseErrorListener`, `removePurchaseErrorListener` now use
`synchronized` blocks
- `sendPurchaseUpdate` and `sendPurchaseError` iterate listeners within
`synchronized` blocks
- Prevents race conditions when listeners are modified from one thread
while being iterated on another

### iOS (`HybridRnIap.swift`)
- Added `RnIapLog.warn` messages when `self` is deallocated (`nil`) in
OpenIAP purchase and error listener callbacks
- Helps diagnose cases where purchase events are dropped due to
`HybridRnIap` lifecycle issues (related to #3150)

## Context

Investigating #3150 (purchases not being notified) revealed a potential
thread safety issue in listener management on Android, and a diagnostics
gap on iOS where purchase events could be silently dropped if the native
module was deallocated.

## Test plan

- [x] `yarn typecheck` passes
- [x] `yarn lint` passes
- [x] Pre-commit hooks pass

🤖 Generated with [Claude Code](https://claude.ai/code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved thread-safety for in-app purchase listener registration and
event dispatch on Android to prevent race conditions.
* Added guards and clearer logging for in-app purchase event handling on
iOS so events are dropped with warnings if the handler is no longer
available.

* **Chores**
* Increased CI/CD deployment validation timeout to allow longer-running
checks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: hyochan

.github/workflows/deploy.yml

@@ -62,7 +62,7 @@ jobs:
 
   validate-ios:
     runs-on: macos-15
-    timeout-minutes: 30
+    timeout-minutes: 60
     env:
       XCODE_VERSION: 16.4
     steps:

android/src/main/java/com/margelo/nitro/iap/HybridRnIap.kt

@@ -255,8 +255,8 @@ class HybridRnIap : HybridRnIapSpec() {
             productTypeBySku.clear()
             isInitialized = false
             listenersAttached = false
-            purchaseUpdatedListeners.clear()
-            purchaseErrorListeners.clear()
+            synchronized(purchaseUpdatedListeners) { purchaseUpdatedListeners.clear() }
+            synchronized(purchaseErrorListeners) { purchaseErrorListeners.clear() }
             promotedProductListenersIOS.clear()
             userChoiceBillingListenersAndroid.clear()
             developerProvidedBillingListenersAndroid.clear()
@@ -731,21 +731,27 @@ class HybridRnIap : HybridRnIapSpec() {
 
     // Event listener methods
     override fun addPurchaseUpdatedListener(listener: (purchase: NitroPurchase) -> Unit) {
-        purchaseUpdatedListeners.add(listener)
+        synchronized(purchaseUpdatedListeners) {
+            purchaseUpdatedListeners.add(listener)
+        }
     }
-    
+
     override fun addPurchaseErrorListener(listener: (error: NitroPurchaseResult) -> Unit) {
-        purchaseErrorListeners.add(listener)
+        synchronized(purchaseErrorListeners) {
+            purchaseErrorListeners.add(listener)
+        }
     }
-    
+
     override fun removePurchaseUpdatedListener(listener: (purchase: NitroPurchase) -> Unit) {
-        // Note: Kotlin doesn't have easy closure comparison, so we'll clear all listeners
-        purchaseUpdatedListeners.clear()
+        synchronized(purchaseUpdatedListeners) {
+            purchaseUpdatedListeners.remove(listener)
+        }
     }
-    
+
     override fun removePurchaseErrorListener(listener: (error: NitroPurchaseResult) -> Unit) {
-        // Note: Kotlin doesn't have easy closure comparison, so we'll clear all listeners
-        purchaseErrorListeners.clear()
+        synchronized(purchaseErrorListeners) {
+            purchaseErrorListeners.remove(listener)
+        }
     }
 
     override fun addPromotedProductListenerIOS(listener: (product: NitroProduct) -> Unit) {
@@ -773,11 +779,10 @@ class HybridRnIap : HybridRnIapSpec() {
             "sendPurchaseUpdate",
             mapOf("productId" to purchase.productId, "platform" to purchase.platform)
         )
-        for (listener in purchaseUpdatedListeners) {
-            listener(purchase)
-        }
+        val snapshot = synchronized(purchaseUpdatedListeners) { ArrayList(purchaseUpdatedListeners) }
+        snapshot.forEach { it(purchase) }
     }
-    
+
     /**
      * Send purchase error event to listeners
      */
@@ -786,9 +791,8 @@ class HybridRnIap : HybridRnIapSpec() {
             "sendPurchaseError",
             mapOf("code" to error.code, "message" to error.message)
         )
-        for (listener in purchaseErrorListeners) {
-            listener(error)
-        }
+        val snapshot = synchronized(purchaseErrorListeners) { ArrayList(purchaseErrorListeners) }
+        snapshot.forEach { it(error) }
     }
 
     /**

ios/HybridRnIap.swift

@@ -899,7 +899,10 @@ class HybridRnIap: HybridRnIapSpec {
         if purchaseUpdatedSub == nil {
             RnIapLog.payload("purchaseUpdatedListener.register", nil)
             purchaseUpdatedSub = OpenIapModule.shared.purchaseUpdatedListener { [weak self] openIapPurchase in
-                guard let self else { return }
+                guard let self else {
+                    RnIapLog.warn("purchaseUpdatedListener: HybridRnIap deallocated, purchase event dropped")
+                    return
+                }
                 Task { @MainActor in
                     let rawPayload = OpenIapSerialization.purchase(openIapPurchase)
                     let payload = RnIapHelper.sanitizeDictionary(rawPayload)
@@ -917,7 +920,10 @@ class HybridRnIap: HybridRnIapSpec {
         if purchaseErrorSub == nil {
             RnIapLog.payload("purchaseErrorListener.register", nil)
             purchaseErrorSub = OpenIapModule.shared.purchaseErrorListener { [weak self] error in
-                guard let self else { return }
+                guard let self else {
+                    RnIapLog.warn("purchaseErrorListener: HybridRnIap deallocated, error event dropped")
+                    return
+                }
                 Task { @MainActor in
                     let payload = RnIapHelper.sanitizeDictionary(OpenIapSerialization.encode(error))
                     RnIapLog.result("purchaseErrorListener", payload)
@@ -935,7 +941,10 @@ class HybridRnIap: HybridRnIapSpec {
         if promotedProductSub == nil {
             RnIapLog.payload("promotedProductListenerIOS.register", nil)
             promotedProductSub = OpenIapModule.shared.promotedProductListenerIOS { [weak self] productId in
-                guard let self else { return }
+                guard let self else {
+                    RnIapLog.warn("promotedProductListenerIOS: HybridRnIap deallocated, promoted product event dropped")
+                    return
+                }
                 Task {
                     RnIapLog.payload("promotedProductListenerIOS", ["productId": productId])
                     do {