Fix #116: atomic incident receiver with durable same-key replay

[Proxicon]

A committed incident can lose its HTTP response; retrying the existing create endpoint then repeats incident, SLA and notification effects. Keyed requests now use a durable registered-source receipt and database uniqueness boundary, committing the incident, accepted response and existing ingress outbox effects together. An authorized retry returns the immutable original response with 200; a changed semantic payload returns 409 without a second create.

Fixes #116. Consumer work: NetRatel #141, connector #152. Separate M2M interoperability: #89.

The preserved POST /api/v1/incidents/ accepts the existing DTO with Idempotency-Key and X-NetRatel-Source-Instance. The receiver adds authenticated capability, receipt lookup and read-only target validation. Interactive administrators register an immutable organization/customer mapping and stable namespace, audit binding changes, and bind replacement API credentials without losing earlier receipts. Every operation rechecks current credential, owner, source and local scope authorization before exposing a result. Replay does not rerun mutable assignee/category rules. Ordinary callers retain IncidentAccess, including its authentication schemes, and their existing create behavior.

The authoritative JSON contract, prose and registration/rotation procedure, 22 frozen semantic vectors and SHA-256 manifest are committed together. Both SQLite and PostgreSQL migration chains were generated through normal EF tooling. Receipt eviction is disabled; full accepted receipts remain indefinitely, with a declared 90-day minimum and 30-day producer automatic retry limit. Capabilities use the configured public API identity and advertise only the implemented api_bearer mode.

Validation:

• Release solution build passes. Receiver/provider/ordinary-create tests: 70 passed, zero failed or skipped; corrected OpenAPI inventory: 2 passed. This includes 52 new receiver cases (22 actual authenticated HTTP/provider cases and 30 golden/key cases), two simultaneous API hosts and separate full API processes, commit-response loss, precommit rollback, database reopen, durable outbox claims, rotation and authorization loss.
• Full solution suite on this head: 1,713 passed, zero failed, six existing skips, 1,719 total. The six pre-existing skips remain unchanged; every new provider case executed. The fixed ordinary-authentication and OpenAPI regression cases also pass in this full run.
• Layout, public disclosure and diff checks pass. Slopwatch reports zero findings in new receiver code/tests; its existing empty-catch finding in unchanged assignment-notification code remains outside this change.
• The mandatory receiver CI job passed on exact head f0ce7a3f65e7c6f96663ca74cd1b97a698a417c8: 52 passed, zero failed/skipped (11 SQLite, 11 PostgreSQL, 30 conformance/key). Retained TRX artifact SHA-256: fac806d0e03e37249235f267a272105268f9c6b9f10f80aa33a49d247dedabb5. Existing mailbox, UX, migration/setup, container and release-rehearsal gates remain enabled.

The exact four-file producer mirror is NetRatel #163, head b6a5011b206af6976eaf399852059e1a5af185cf. Its files and SHA-256 manifest match the receiver byte-for-byte. Implementation self-review is anchored to the final head.

This change creates no production tickets, pairing UX or release. Published beta.8 remains incompatible. The next compatible prerelease must contain this merge and migrations; configure the public API URL, register the approved source and verify the authenticated live capability before enabling NetRatel automatic delivery/retry. Keep the producer's internal Flow fingerprint distinct from the receiver projection.

Final deployment handoff: receiver #117 plus compatibility follow-up #118 are merged at fccae98. All 17 checks passed on each reviewed PR head and on this final main merge. Main validation and managed PostgreSQL validation are green. Main receiver acceptance: 52 passed, zero failed/skipped (11 SQLite, 11 PostgreSQL, 30 conformance/key); full suite: 1,713 passed, zero failed, six existing skips. Use this final merge SHA for the subsequent compatible build. No release, production deployment, live ticket or tag/latest promotion was produced.

[Proxicon]

Implementation review of f0ce7a3 (self-review; not an independent approval): checked current authorization precedence, ordinary IncidentAccess scheme preservation, stable audited source rotation, provider uniqueness/reservation and rollback, fresh scoped losing-writer retries, immutable replay/lookup, existing ingress outbox transaction/tenant binding, fingerprint vectors, bounded input and Kestrel dot-segment handling, both generated migration chains and retention without key recreation.

Two concrete regression findings were fixed before this head: the extracted create boundary initially used the default authentication scheme for ordinary callers, and OpenAPI inventory did not include the seven new operations/canonical source path. The unchanged ordinary-create tests and corrected OpenAPI tests now pass; receiver acceptance executed on both real providers with zero skips. Full-suite and exact-head CI remain the merge gates.

No outstanding substantive finding from this review. Deployment still requires a new compatible build/migrations, approved source registration and authenticated live capability. No SMTP exactly-once claim, OAuth support or release publication is made. The exact contract/fixture mirror is NetRatel #163; automatic delivery remains gated.