idempotency: wire Idempotency-Key plugin into mutating endpoints

[themightychris]

The idempotency plugin (apps/api/src/plugins/idempotency.ts) is implemented and registered, but no route handler calls it — mutating endpoints don't honor the Idempotency-Key header yet.

specs/api/conventions.md#idempotency documents the target contract and now carries a status note marking it not-yet-wired (surfaced by the spec-drift audit).

Do: wire idempotency into the at-risk mutating endpoints — start with POST /api/projects/:slug/updates (the double-tap case the spec cites) — plus per-route tests. Then remove the status caveat from conventions.md.