v4.0.0

POST /orders now accepts an Idempotency-Key header. The first call stores the answer it returned under that key in the same transaction as the order, its outbox row and its timeline entry, so the key and the effect can never disagree, and a repeat is answered from the store byte for byte with Idempotent-Replay: true instead of placing a second order. Two calls racing on one key both try to store the answer; the primary key lets one of them through and the loser rolls back its own order and returns what the winner wrote. On the way out the relay stamps an attempt on an outbox row before it sends and marks it published only after the broker acknowledged it, so a row that comes back attempted but unpublished is exactly the crash window between the two and is sent again and counted in ledgermesh.outbox.resends. The redelivery changes nothing downstream because the consumer recognises the event id it already applied, which the new tests check against the stock ledger and the payment for the order.