idempotency: wire Idempotency-Key plugin into mutating endpoints

The idempotency plugin (`apps/api/src/plugins/idempotency.ts`) is implemented and registered, but **no route handler calls it** — mutating endpoints don't honor the `Idempotency-Key` header yet.

`specs/api/conventions.md#idempotency` documents the target contract and now carries a status note marking it not-yet-wired (surfaced by the spec-drift audit).

**Do:** wire idempotency into the at-risk mutating endpoints — start with `POST /api/projects/:slug/updates` (the double-tap case the spec cites) — plus per-route tests. Then remove the status caveat from conventions.md.

Read apps/api/src/plugins/idempotency.ts and the idempotency section of specs/api/conventions.md first, then locate the handler for POST /api/projects/:slug/updates. Run or add the per-route tests for the double-tap case, wire the plugin into the at-risk mutating endpoints, and remove the not-yet-wired status caveat once the contract is covered.

Written by the indexing model from the issue text.