idempotency: wire Idempotency-Key plugin into mutating endpoints

The idempotency plugin (`apps/api/src/plugins/idempotency.ts`) is implemented and registered, but **no route handler calls it** — mutating endpoints don't honor the `Idempotency-Key` header yet.

`specs/api/conventions.md#idempotency` documents the target contract and now carries a status note marking it not-yet-wired (surfaced by the spec-drift audit).

**Do:** wire idempotency into the at-risk mutating endpoints — start with `POST /api/projects/:slug/updates` (the double-tap case the spec cites) — plus per-route tests. Then remove the status caveat from conventions.md.