Deduplication
Fulfill exactly once on top of at-least-once HTTP delivery.
After signature and freshness verification, insert a unique (merchant scope, eventId) record and commit the fulfillment decision in the same database transaction. If the event ID already exists, return 2xx without fulfilling again. Do not deduplicate by signature or timestamp because both can change on retry.