feat(nzb-web): idempotent queue admission via Idempotency-Key

[thedancingdeveloper]

Summary

Ports the idempotent queue-admission feature from MrVampy/rustnzb (fe7c35d): a durable, at-most-once admission path for queue adds, so a caller that retries an ambiguous POST /api/queue/add cannot create a duplicate job. Main had no equivalent.

What it adds

• queue_admissions table (DB migration v11) keyed by idempotency key, binding it to a payload digest and job id. It intentionally has no foreign key to queue/history, so it stays authoritative after a job moves or bounded history is pruned.
• Idempotency-Key header handling (apps/rustnzb/src/admissions.rs): parsed/validated, path-safe, ≤128 bytes, with a SHA-256 payload digest; plus GET /api/queue/admissions/{key} to resolve one admission and its current engine location (queue / history / unobserved).
• DB layer: Database::queue_admit (transactional admission bind + queue insert) and queue_admission_observe.
• QueueManager: add_job_idempotent and queue_admission_observe, with add_job refactored so the shared activation path is activate_admitted_job (no double insert).
• Conflict semantics: new NzbError::AdmissionConflict → HTTP 409 admission_conflict when a key is reused with a different payload. A keyed add must carry exactly one NZB (multi-payload uploads 400).

Port notes

• Migration renumbered v9 → v11: main already uses v9 (retry_data) and v10 (damage_ledger).
• The fork's flake.nix/flake.lock and workspace version bumps are excluded.
• Digests use hex::encode because main is on sha2 0.11, whose output no longer implements LowerHex (identical lowercase hex output).
• The integration test now completes first-run auth setup and sends a bearer token, since main gates /api behind auth middleware (the fork's test predated it).

Tests

• DB unit: queue_admission_replays_exact_payload_and_rejects_conflict, queue_admission_survives_reopen_and_outlives_queue_observation.
• admissions unit: key validation + digest binding.
• End-to-end idempotent_admission suite: exact replay returns one job; conflicting payload 409s (error_kind: admission_conflict); keyed multi-payload upload 400s; observation endpoint reflects queue state.
• Full suites pass: nzb-core (130), nzb-web (104+), rustnzb (all); cargo clippy --workspace --all-targets + cargo fmt --check clean.

Original author: @MrVampy (credited via Co-Authored-By; ported by hand due to migration collision and rewritten queue/handler code on main).

🤖 Generated with Claude Code