backend: expose idempotency replay header

[artylobos]

Summary

• Set X-Idempotent-Replayed: false for fresh idempotent writes and true for cached replays.
• Expose the replay/cache headers through CORS so browser clients can read them.
• Add Jest coverage for first execution, sequential replay, and CORS exposed headers.
• Document the idempotency replay header for API consumers.
• Format the two existing frontend e2e specs that repository-wide frontend Prettier already checks, so this PR can pass CI without changing e2e behavior.

Closes #884

Validation

• npm ci --ignore-scripts
• npm test -- --runTestsByPath src/tests/idempotency.test.ts src/__tests__/cors.test.ts --runInBand -> 6 passed
• npm run build -> passed
• npm run typecheck -> passed
• npx prettier --check src/middleware/idempotency.ts src/tests/idempotency.test.ts src/app.ts src/__tests__/cors.test.ts ../docs/wiki/api-idempotency.md ../docs/wiki/README.md -> passed
• npx --yes prettier@3.8.1 --check frontend/e2e/borrower-repay-flow.spec.ts frontend/e2e/lender-withdraw-flow.spec.ts -> passed
• npm run lint -> 0 errors; existing repository warnings remain
• npm test -- --runInBand -> 35 passed, 2 skipped; 211 tests passed, 18 skipped
• git diff --check -> passed

No secrets, private keys, wallet material, or deployment values are included.