fix(api): W11 hardening — scrub internal_url for anon, wire X-Idempotent-Replay (P1 regressions)

[mastermanas805]

Summary

Two P1-flagged API hardening regressions, one PR (tests ship in same PR per Manas's iron rule).

Fix 1 — Scrub internal_url for anonymous-tier provision responses

P1 (anon AI agent persona) found that anonymous POST /db/new, /cache/new, /nosql/new, /queue/new, /vector/new responses included internal_url: instant-pg-proxy.instant.svc.cluster.local:5432 (and the redis/mongo/nats equivalents). This leaks cluster infra topology to any unauthenticated curl, and serves zero purpose for anon callers — they can't run /deploy/new workloads (which is what the internal proxy is for) without a claimed team.

• New helper setInternalURL(resp, tier, connectionURL, kind) in internal/handlers/internal_url.go is the single chokepoint for the omit-on-anon rule.
• ~12 handler callsites switch from inline "internal_url": map literals to setInternalURL calls (or get the field stripped entirely on known-anonymous response paths).
• Paid tiers (hobby, hobby_plus, pro, growth, team) still receive internal_url unchanged — Pro users running compute alongside their DB legitimately need it (DOKS doesn't hairpin public LB traffic).

Fix 2 — Lock X-Idempotent-Replay precedence vs fingerprint dedup

P1 reported Idempotency-Key appeared silently shadowed by fingerprint dedup. Investigation showed the middleware wiring in internal/router/router.go already places Idempotency BEFORE the handler (OptionalAuth → RequireWritable → Idempotency → handler), so a cache hit DOES short-circuit before the handler's fingerprint-dedup branch runs, and idempotency.go:164 DOES set the replay header. The contract was already structurally correct — what was missing was explicit black-box coverage that pins the precedence at the HTTP boundary so a future per-route misconfig fails loudly in CI.

• Expanded idempotency.go header doc-block with an explicit precedence section.
• Added three e2e tests covering all three branches: cache-hit replay (header set), conflict (409), no-key path (header MUST be absent even when fingerprint dedup applies).

Files changed

Fix 1

• internal/handlers/internal_url.go — new setInternalURL helper + internalURLResponseKey / tierAnonymous named constants
• internal/handlers/internal_url_test.go — TestSetInternalURL (7 cases: anonymous omits, hobby/pro/team/growth emit, empty URL omits) + TestSetInternalURL_ReturnsSameMap
• internal/handlers/db.go, cache.go, nosql.go, queue.go, vector.go — scrub internal_url on anonymous response paths; route paid paths through helper
• e2e/w11_anon_internal_url_e2e_test.go — black-box assertion that POST /cache/new from anon caller returns no internal_url

Fix 2

• internal/middleware/idempotency.go — doc-block: explicit precedence section covering all three branches
• e2e/w11_idempotency_e2e_test.go — three tests: same-key replay sets header, different-body returns 409, no-key path still works without header

Test plan

• go build ./... — clean
• go vet ./... — clean
• go test ./internal/handlers/ -run "TestSetInternalURL|TestProxiedInternalURL" -count=1 — PASS (10 cases)
• go test ./internal/middleware/ -count=1 — PASS (no regressions)
• go build -tags e2e ./e2e/... — clean
• E2E run against live cluster: deferred to operator (Manas) per "DO NOT deploy" instruction. Image will batch-deploy with FIX-1/FIX-2/FIX-3/W11-F2 as v6.2.3.

Pre-existing failures (not regressed by this PR, confirmed against origin/master)

• TestTeamSelf_Get_ReturnsTeamRow / TestTeamSelf_Patch_RenamesTeam — models.GetTeamByID Scan column-count mismatch (schema drift).
• TestAll_ReturnsAllPlans / TestHobbyPlus_TierMatrix / TestYearlyVariants_MirrorMonthly — plans.yaml drift from hobby_plus addition in W11: add hobby_plus tier ($19/mo) to api #92.

🤖 Generated with Claude Code