fix: enforce idempotency for change requests

[garvitkaushik-123]

Summary

• require a non-empty idempotency key on change-request creation
• replay the original change request for identical requests scoped to the same order
• return the shared idempotency conflict response when a key is reused with a different payload
• expire idempotency records after 24 hours, matching the other FD-12 endpoints

Why

POST /api/v1/change-requests was the only FD-12 money-mutating surface without replay protection. A client retry could create a second change request and place a duplicate material change into the approval queue.

The implementation follows the existing quotes/deals router pattern while preserving the current change-request payload fields. The namespace is scoped by order because this route permits optional authentication.

Testing

• added coverage for missing keys, identical replay, changed-payload conflicts, per-order scoping, and the 24-hour TTL
• updated existing change-request lifecycle tests for the required field
• full suite: 1,484 passed, 28 skipped
• changed-file lint, formatting, and whitespace checks pass

Closes #62