Idempotency

Same `Idempotency-Key` replays the same result within actor scope: authenticated user / `api_key_id`, or sealed `anonymous_client_id` (not IP-only). Concurrent in-flight keys serialize or return in-progress + `Retry-After`.

• Header Idempotency-Key required (max 256)
• TTL 24h; same key + same body → replay
• Concurrent in-flight → IDEMPOTENCY_IN_PROGRESS + Retry-After
• Anonymous scope: sealed X-Duan-Client-Id / anonymous_client_id + Idempotency-Key (not IP-only). Browsers may use duan_anon.