feat(idempotency): durable, payload-bound idempotency for postage mutations

[Nanle-code]

Summary

Idempotency records were already persisted durably (Durable Object storage,
surviving restarts and shared across Worker instances), but the key hash
only bound to actor:rawKey — not the request payload, method, or route.
A reused key with a different payload would silently replay the wrong
cached response instead of failing closed, and refund had no idempotency
support at all despite being as payment-critical as settle.

• Bind every lease/response to a canonical digest of the request payload;
  a reused key with a different payload now returns 409 idempotency_mismatch
  instead of an incorrect replay or block
• Scope the key hash by actor + HTTP method + route template, not actor alone
• Add withIdempotency(), a single entry point that acquires the lease,
  replays completed records, records terminal outcomes, and — critically —
  releases the lease on an uncached transient failure, so a legitimate
  retry isn't blocked for the full lease TTL
• Wire postage submit and settle onto the new helper, and add the same
  idempotency support to postage refund, which previously had none
• Bump the idempotencyRecord schema to v2 with a migration for legacy
  records predating requestDigest

Closes #1498

Acceptance criteria

• Duplicate identical requests replay the stored response
• A reused key with a different payload returns 409
• Concurrent duplicates execute the operation once
• Behavior survives independent API contexts (Durable Object storage,
  verified with two independent coordinator instances sharing storage)

Test plan

• npx vitest run tests/unit — 1688 passing, 3 pre-existing expected-fail
• npx tsc --noEmit — clean
• npx eslint on all changed files — clean
• New coverage: digest-mismatch conflicts, concurrent-duplicate races,
  transient-failure lease release, and route-level tests for settle/refund