Idempotency and duplicates

Optional but always recommended on creation:

Idempotency-Key: order-1001-create

Repeating the same request with the same key returns the same payment, with no duplicate.

Two verified behaviours that differ from the industry standard:

1. Same key plus a different body returns the original payment, with no error. (Stripe would return 422.) The key wins and the body is ignored on replay. If a bug reuses a key for a different amount, you get a 201 describing a charge nobody asked for. -> Derive the key from the order's content (for example a hash of id, amount and currency), not only from its identifier.

2. external_reference is not unique. Without an Idempotency-Key, sending it twice creates two distinct payments. The idempotency key is the only duplicate protection.