Idempotency

Stops a retried API request from being processed twice.

A client sends an `Idempotency-Key` header. If the same key arrives again, the
stored response is replayed instead of the operation being repeated. One order,
not two.

This matters whenever a write is expensive to duplicate. A network timeout gives
the client no way to know whether its request succeeded, so a correct client
retries — and without protection that retry creates a second record.

Works with core REST, JSON:API and custom controller routes through one
mechanism.