feat: voucher clone (single-use, exactly-once, idempotent) (bounty #8)

[Kasuki354]

Summary

Implements bounty #8: Voucher clone (single-use redemption, exactly-once under concurrency, idempotent per (voucher, user))

Invariant

Concurrent redeems of one voucher -> counted once; the rest get a clean 409. Zero 5xx. Same idempotency key + different body -> 409.

Implementation

Backend:

• Voucher model: id, code (unique), cloneSlug
• Redemption model: voucherId (unique = single-use), (voucherId, userId) unique = idempotent per user
• POST /clones/:slug/vouchers: create voucher with code
• POST /vouchers/:id/redeem: single-use via unique on voucherId, idempotent via unique on (voucherId, userId)
• On P2002: check if same user (idempotent 200) or different user (409 voucher_taken)
• Structured logging: voucher.created, voucher.redeemed, voucher.idempotent_replay, voucher.taken
• Metrics updated with voucher + redemption counts

Frontend:

• /clones/voucher page with create form (code) and redeem form (voucher ID + user ID)

Tests:

• Happy path: create + redeem, idempotent retry (200), different user after redemption (409)
• Concurrency: 50 same-user concurrent -> 1 win + 49 idempotent, zero 5xx
• Concurrency: 50 different-user concurrent -> 1 win + 49 get 409, zero 5xx
• Error: 404 non-existent, 400 empty code

AI Use Disclosure

Implementation written by AI agent (Kasuki354). No secrets, tokens, or credentials included.

Resolves #8