Idempotency

• POST /v1/orders requires an Idempotency-Key request header; the published schema specifies a maximum of 190 characters. It is the only operation that requires one, and a missing key is refused with 400 invalid_request.
• A repeat with the same key and the same body returns the same order rather than creating a duplicate.
• Reusing the same key with a different body is refused with 409 conflict.
• Retry a network failure or a 500 with the same key; never mint a new key for the same logical order.

Webhook delivery and the event stream are at-least-once and may arrive out of order. Deduplicate on event_id, ignore a delivery identifier already processed, and keep handlers idempotent.