Idempotency

Same `Idempotency-Key` replays the same result within actor scope: authenticated user/api_key_id, or Soft D2.2 `anonymous_client_id` (not IP-only). Concurrent in-flight keys serialize or return in-progress + `Retry-After`.

• Header Idempotency-Key required (max 256)
• TTL 24h; same key + same body → replay
• Concurrent in-flight → IDEMPOTENCY_IN_PROGRESS + Retry-After
• Soft D2.2 anon scope: sealed X-Duan-Client-Id + Idempotency-Key (not IP-only). Browsers may use duan_anon.