Deadlock between /purchase and /admin/update endpoints: updateUserBalance acquires userMutex then productMutex, while /admin/update calls getProduct (productMutex) then getUser (userMutex) before calling updateUserBalance, causing circular lock dependency when requests interleave.
