retries need idempotency keys

For a state-changing API, an idempotency key lets a retry map to the same operation. Store the key and outcome atomically with the state change, scoped to the caller and operation. Otherwise, two concurrent retries can both pass a check-then-write.