API: Idempotency-Key on creating POSTs #708

Description of Feature:

Idempotency-Key on creating POSTs, following draft-ietf-httpapi-idempotency-key-header (revision -08, October 2026).

What value is this feature adding to Source Cooperative?

When a create succeeds but its response is lost, a retry today creates a second resource wherever the server generates the ID. A membership invitation gets a fresh randomUUID() in src/lib/operations/memberships.ts, so a retried invite makes a duplicate, and a retried API-key create mints a second key. With a key, the retry replays the first answer instead.

Products don't need it: the caller chooses product_id, so a retried create gets 409.

Scope

• A repeated key with the same body replays the first response. The same key with a different body answers 422, a key whose first request is still in progress answers 409, and an endpoint that requires a key answers 400 without one, as revision -08 specifies. Each is a PROBLEMS entry in src/lib/api/problems.ts.
• Keys are stored in DynamoDB with a TTL, and an endpoint opts in through withApiSession in src/lib/api/handler.ts.
• Check which other POSTs generate their IDs, and opt those in.
• source-coop-cli sends one key per logical create, and reuses it when retrying or resuming.
• API.md says which endpoints take a key and how long a key is remembered.