Improve API idempotency replay evidence

[DENGXUELIN]

Summary

• Adds a cross-cutting idempotency and replay evidence gate to api-security.
• Requires operation inventory, key/event/nonce/version controls, actor/tenant/resource/payload binding, atomic duplicate detection, retry-safe responses, replay windows, and duplicate/replay logging.
• Adds vulnerable and benign fixtures for duplicate payment/webhook replay versus controlled payment/webhook/GraphQL replay handling.

Issue

Fixes #1682

Validation

• git diff --check origin/main...HEAD
• Markdown fence balance check
• Added-line ASCII check
• Content marker check for API-REPLAY-* and fixture expectations
• git merge-tree --write-tree origin/main HEAD

Bounty

Requested tier: Improver Moderate ($100) if accepted/merged.