feat(idempotency): IdempotencyKeyMiddleware + RequestBodyHasher (#173)

[tonydspaniard]

Closes #173. Part of #171. Depends on #172.

Summary

Adds the PSR-15 middleware that drives the #172 storage layer. Reads the Idempotency-Key header, hashes the request body, and coordinates with the store so a replayed request returns the original response and a key reused with a different payload is rejected with 409.

Behaviour matrix

Situation	Response
GET / HEAD / OPTIONS	Pass through; no caching.
Header absent, mode=optional	Pass through.
Header absent, mode=required	400 with {error} envelope.
Header malformed (>255 chars, ctrl chars, whitespace)	400.
Key unseen	Claim; execute; cache; return.
Key seen, same hash, completed	Replay + Idempotency-Replayed: true.
Key seen, same hash, in-progress (\xe2\x89\xa4 maxWait)	Wait + retry; replay when ready.
Key seen, same hash, in-progress (> maxWait)	409.
Key seen, different hash	409.
Handler throws	Release claim; re-throw.
Streaming response (chunked or text/event-stream)	Pass through without caching.

Header policy

Response headers are stored on an allow-list (default Content-Type, Location, Link). Set-Cookie, Authorization, and anything not on the list are never written to shared storage. Verified by test.

RequestBodyHasher

SHA-256 over the raw bytes \xe2\x80\x94 not parsed JSON. Semantically equivalent bodies with different whitespace produce different hashes. The hasher rewinds the body stream after reading so downstream handlers see the content from position 0.

Files

Layer	Files
Middleware	src/Altair/Idempotency/Middleware/IdempotencyKeyMiddleware.php
Hasher	src/Altair/Idempotency/Hash/RequestBodyHasher.php
Composer	psr/http-factory, psr/http-message, psr/http-server-handler, psr/http-server-middleware added to univeros/idempotency (no coupling to univeros/http)
Tests	tests/Idempotency/Hash/RequestBodyHasherTest.php, tests/Idempotency/Middleware/IdempotencyKeyMiddlewareTest.php (20 new)

Test plan

• composer cs \xe2\x80\x94 green
• composer stan \xe2\x80\x94 green
• composer rector (full tree, no cache) \xe2\x80\x94 green
• composer test \xe2\x80\x94 6275 tests (+20 new), 0 new failures
• bin/altair manifest:generate \xe2\x80\x94 clean

Out of scope

• The idempotency: spec block + scaffolder wiring \xe2\x80\x94 idempotency: spec block + scaffolder integration (AST + parser + validator + emitter wiring) #174.
• x-altair-idempotency round-trip activation \xe2\x80\x94 x-altair-idempotency round-trip activation: forward emit + reverse import + drift gate #175.
• Package doc + benchmark variant \xe2\x80\x94 docs/packages/idempotency.md + tokens-to-ship benchmark variant exercising replay #176.