Feature/request deduplication idempotency

[mijinummi]

Request Deduplication Middleware for Idempotency (#326)

Overview

This PR introduces request deduplication middleware to ensure idempotent operations for critical API actions.

Changes

• Added IdempotencyMiddleware to detect duplicate requests
• Implemented IdempotencyService with Redis SETNX for atomic checks
• Supported client-provided idempotency keys (X-Idempotency-Key)
• Auto-generated keys for unsafe operations (POST, PUT, DELETE)
• Configured TTL per endpoint type (puzzles, points, friends, profile updates)
• Cached responses include status codes and headers
• Registered middleware globally in AppModule

Acceptance Criteria Met

• ✅ Duplicate puzzle submissions return same result
• ✅ Point claiming cannot be triggered multiple times
• ✅ Client-provided keys honored
• ✅ Auto-generated keys supported
• ✅ Race conditions handled
• ✅ TTL applied per endpoint
• ✅ GET requests excluded
• ✅ Minimal performance overhead

Next Steps

• Add monitoring/logging for duplicate attempts
• Integrate distributed locks for high-concurrency scenarios
• Extend idempotency to payment transactions
  Closes Request Deduplication Middleware for Idempotency #326

[drips-wave]

@mijinummi Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits