Audit package and payment idempotency across checkout and proof submission

[Taleef7]

Context

docs/plan-CorvEd.md still calls out package/payment idempotency as a reliability check. The package creation page has duplicate guards, but launch readiness needs proof that repeated submits, back-button retries, and rejected-proof reuploads cannot create inconsistent package/payment state.

Acceptance criteria

• Test repeated package selection/submission for the same request and tier.
• Test payment proof upload/reupload after rejection and ensure only the intended payment row is updated.
• Confirm request/package/payment statuses remain consistent after retries or failed uploads.
• Add server-side guardrails or tests for any uncovered duplicate path.
• Document the final expected behavior in the relevant docs.

References

• docs/plan-CorvEd.md section 4.4 reliability
• docs/MVP.md package/payment lifecycle
• app/dashboard/packages/new/page.tsx
• app/dashboard/packages/[id]/page.tsx