feat(backend): make vault mutations idempotent under client retries

[arisu6804]

Problem

Network retries can cause duplicate deposits, withdrawals, or state transitions when a client resubmits a request after a timeout.

Objective

Deliver a production-quality improvement to vault and transaction mutation endpoints that creates measurable value for correctness, security, reliability, performance, or maintainability.

Implementation scope

• Accept an idempotency key scoped to the authenticated actor and operation.
• Persist the request fingerprint and terminal response so safe retries return the original result.
• Reject reuse of a key with a different payload and make concurrent requests converge on one mutation.

Acceptance criteria

• A successful retry returns the original response without duplicating state or side effects.
• Conflicting key reuse returns a clear client error.
• Concurrency tests prove only one ledger mutation and one audit event are produced.

Required validation

• Unit, integration, and concurrent-request tests for success, timeout retry, conflict, and process restart.
• Existing tests and CI remain passing.
• Add regression coverage for the original failure mode.
• Do not weaken, delete, or skip unrelated tests to obtain a green build.

PR quality bar

• Keep the PR focused on this issue and explain design tradeoffs.
• Include test evidence, compatibility impact, and migration or rollout notes where relevant.
• Avoid typo-only, documentation-only, cosmetic-only, or unrelated refactor submissions.

Out of scope

• Broad rewrites not required by the acceptance criteria.
• Changes to unrelated services, contracts, or user flows.