feat(escrow): enforce idempotency keys on funding submissions

[chisomvictorcv-sketch]

Closes #201

Summary
Adds durable idempotency-key enforcement to POST /api/invest/fund-invoice so identical retries return the original response instead of double-submitting.

Changes

New: src/middleware/idempotency.js

• Validates Idempotency-Key header against existing IDEMPOTENCY_KEY_PATTERN
• Stores key → (SHA-256 request fingerprint, status, response) in idempotency_keys table
• Returns cached response on duplicate key with same body
• Returns 409 when key reused with different body
• Configurable TTL via IDEMPOTENCY_KEY_TTL_HOURS env (default 24h)

New: migrations/20260601000000_create_idempotency_keys.sql

• idempotency_keys table with UUID PK, key, fingerprint, response, TTL
• Unique index on key, expiry index for cleanup

Modified: src/routes/invest.js

• idempotencyMiddleware added to POST /fund-invoice before requireKycForFunding

New: tests/idempotency.test.js
8 tests:

• Missing header → 400
• Invalid characters → 400
• Too short key → 400
• First call executes → 201
• Duplicate key + same body → 201 replay
• Same key + different body → 409
• Multiple different keys → both succeed
• Empty body → handled

Security

• Keys validated before any DB access
• Request body SHA-256 hashed — no raw payload persisted
• Keys expire automatically

[drips-wave]

@chisomvictorcv-sketch Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[chisomvictorcv-sketch]

@drips-wave