Deduplicate events and orders

Retries and manual redelivery can repeat a valid event. X-Event-Id is the logical event identity; X-Delivery-Id belongs to one endpoint delivery. Deduplicate both logical event and business order. Do not use attempt number or delivery ID as the only business key.

After raw-body verification and authenticated PAID lookup with the saved order/project/mode/currency/pricing binding, perform one database transaction: insert a unique (merchant_scope, eventId), mark the bound order paid under a unique order/session constraint, and enqueue fulfillment in a durable outbox. An already accepted event or already paid order must not enqueue a second fulfillment. Commit before returning a small 2xx. A transient storage/read failure should remain retryable.

verify signature and signed event type
load saved order binding and authenticated PAID session
transaction:
  insert unique event or recognize duplicate
  transition bound order to paid only once
  insert unique fulfillment outbox job
commit
return 2xx

Never fulfill once for the session and again for its child invoice. Test events, treasury credits, connection tests, browser redirects and review receipts cannot pay a Live order.