fix(billing): prevent duplicate refunds during provider retries and concurrent submissions

[VerifiedFlemzy1]

Closes #1167

Summary

Resolves duplicate refund application issues caused by provider retries, network replays, or concurrent client submissions sharing the same Idempotency-Key.

Changes Made

• Atomic Upsert & Conflict Handling: Updated idempotencyMiddleware in src/middleware/idempotency.ts to perform atomic INSERT ... ON CONFLICT (idempotency_key) DO NOTHING. If a concurrent request is already inserting the key, the subsequent execution detects the record and handles it safely without racing.
• Race Condition Protection: Ensured in-progress duplicate requests receive a 409 conflict while completed requests receive the cached idempotent response with Idempotent-Replayed: true.
• Concurrency Test: Added unit test prevents duplicate refunds on concurrent retries with the same Idempotency-Key in src/routes/billing/refund.test.ts to assert that developer balances are only credited once under concurrent submissions.

Verification

• npx jest src/middleware/idempotency.test.ts (27/27 passed)
• npx jest src/routes/billing/refund.test.ts (9/9 passed)

[drips-wave]

@VerifiedFlemzy1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits