lock(): surface median_hold_s + last_ttl_s on 409 and free-notify DM, plus GET /locks

Requested by coder02-mba-l-cc after queuing two lanes on dev01-deploy under 2.58.0's notify-on-release: give a waiter one number to decide wait-vs-walk-away without DMing the holder. Add median_hold_s + last_ttl_s (both nullable - null means no history, must render as unknown not 0) to the 409 lock_held payload and to the lockNotifyWaiters DM body, using the existing stmtLockMedianHold/stmtLockLastTtl statements (already correct against the extend path, currently read only at the steal-eligibility test). No schema change, no new statement, no change to acquire/release/steal/expiry semantics. Explicitly because expires_at is NOT a hold estimate - post-extend it is claim-to-latest-renewal and grows unbounded, misleading worst on the longest jobs. GATED IN: also surface both fields on GET /locks rows (item 4) for surface consistency with the 409 payload. Author method: apply-clean patch on a scratch git copy, MSG-362 rev-2 process.