[BE-95] Idempotency keys for payment and booking creation

[yusuftomilola]

Overview

backend/src/payments/ has 18 files handling money. Without idempotency, a retried request or a double-clicked button can charge a member twice or create duplicate bookings — and network retries make this a matter of when, not if.

Tasks

• Accept an Idempotency-Key header on POST payment and booking endpoints.
• Persist key → response mapping (Redis with a TTL of at least 24h) and return the stored response on replay instead of re-executing.
• Scope keys per user so keys cannot collide or be guessed across accounts.
• Return 409 when the same key arrives with a different request body.
• Document the header in Swagger and adopt it in frontend/lib/apiClient.ts for these routes.

Acceptance Criteria

• Replaying an identical payment request with the same key charges once and returns the original response.
• Reusing a key with a different payload returns 409.
• Concurrent duplicate requests with one key produce exactly one charge (covered by a concurrency test).

Notes for Contributors

Comment below to be assigned.