Fix /rewriteGroups guard+await and release device lock on aborted upload

[jaeming]

Two small, version-independent fixes.

1. /rewriteGroups — broken guard and missing await

if (!assertPresent(res, req.body.groups));   // stray ';' -> guard is a no-op
awaitPromiseReturnStatus(rewriteDiscGroups(device, {
    ...getCachedContent(),                    // async, not awaited -> spreads a Promise
    groups: req.body.groups.map(convertGroupToNJS)
}), res);

The ; after the if makes the presence check do nothing, and getCachedContent() is async, so ...getCachedContent() spreads a Promise rather than the cached disc. Fixed by returning on the guard and awaiting the disc.

2. /upload — device lock leaks on aborted/stalled uploads

The mutex acquired for an upload is only released on the success path. If the client closes the tab, disconnects, or the write throws, the lock is never released — so every subsequent upload hangs forever on mutex.acquire() (looks like a permanent "stuck at 0%" until the server is restarted).

Hoist the release and free it on socket close/error and on failure, using a finished/terminal guard so a mid-stream parse error doesn't release the lock early.

Both are independent of the netmd-js version.