幂等

相同 `Idempotency-Key` 在作用域内重放同一结果：已认证用户/api_key_id，或 Soft D2.2 `anonymous_client_id`（非仅 IP）。并发进行中则串行，或返回进行中并带 `Retry-After`。

• Header Idempotency-Key required (max 256)
• TTL 24h; same key + same body → replay
• Concurrent in-flight → IDEMPOTENCY_IN_PROGRESS + Retry-After
• Soft D2.2 anon scope: sealed X-Duan-Client-Id + Idempotency-Key (not IP-only). Browsers may use duan_anon.