feat: add idempotency and duplicate-submission protection

[m-hajjo]

Problem

Players could submit the same answer multiple times (double-clicks, network retries, browser refreshes, or malicious requests), causing duplicate XP awards, double session advancement, and duplicate reward eligibility.

Solution

Introduced a Redis-backed IdempotencyService using SETNX-based lock + result caching. Every write path now wraps its core logic in idempotency.execute(key, fn), which guarantees the function runs at most once per key within a configurable TTL (default 24h).

Protocol:

1. Check for a cached result → if found, return it (duplicate: true)
2. Attempt to acquire a Redis lock (SETNX, 60s TTL) → if acquired, run fn, store the result, release the lock
3. If the lock is held by a concurrent request → poll until the result appears or the lock expires, then force-acquire

Closes #626

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
mind-block-app-frontend	Skipped		Aug 22, 2026 7:25am