feat(api): add idempotency middleware for POST mutations

[220nightmore-spec]

Summary

Closes #179.

• add an Idempotency-Key middleware for POST mutations with route/principal/request-body scoping
• add in-memory and Postgres-backed idempotency stores plus the idempotency_keys migration
• document replay/conflict/concurrency behavior and expose the header in OpenAPI
• cover pass-through, replay, body-conflict, and concurrent duplicate handling with focused tests

Security notes

• raw idempotency keys and auth headers are hashed before storage
• 5xx responses are not cached, so transient failures can be retried
• same-key/different-body reuse returns 409 Conflict
• in-memory dev/test store waits for in-flight duplicates; Postgres store returns 409 + Retry-After for in-flight duplicates across instances to avoid duplicate mutation execution

Validation

• vitest run src/middleware/__tests__/idempotency.test.ts --pool=forks --maxWorkers=1
• eslint src/middleware/idempotency.ts src/services/idempotencyStore.ts src/middleware/__tests__/idempotency.test.ts
• node --input-type=module -e "import fs from 'node:fs'; import yaml from 'yaml'; yaml.parse(fs.readFileSync('src/openapi.yaml', 'utf8')); console.log('OpenAPI spec valid');"
• git diff --check

tsc --noEmit --pretty false is currently blocked by existing unrelated repo errors in files such as src/app.ts, src/container/Container.ts, src/middleware/requestLogger.ts, src/routes/creditBulk.ts, src/routes/simulation.ts, and src/services/drawWebhookService.ts; no idempotency files were reported in that failure list.