Migrate `open-position`/`close-position` to POST

[YaronZaki]

• Difficulty: good-first-issue · Effort: S · Impact: route semantics
• Problem Statement
  quantara/web_app/api/position.py declares mutations as @router.get(...).
  GETs are cached and prefetched by browsers and CDN; replaying a
  cached open-position URL through the browser executes a state change.
• Expected Outcome
  Both endpoints POST. Idempotency-Key header supported so retries are
  safe.
• Acceptance Criteria
  • OpenAPI spec shows POST.
  • Old GET URLs return 405.
  • Replaying POST with same Idempotency-Key returns same response with no double write.
• Implementation Notes
  Existing tests in tests/test_positions.py (which currently call client.get)
  must be updated to POST.
• Files / Modules Affected
  • quantara/web_app/api/position.py
  • new: quantara/web_app/api/middleware.py::IdempotencyKeyMiddleware
• Dependencies: ties with #5 (CSP) for response uniformity.