Add API idempotency replay gates

[yanziwei]

Summary

Closes #1682.

• Adds a state-changing idempotency and replay evidence gate to api-security.
• Adds evidence requirements for idempotency keys, replay windows, duplicate detection storage, response consistency, authorization binding, concurrency behavior, and observability.
• Adds finding criteria for replayable payment/transfer/destructive operations, missing duplicate controls, unsafe binding, local-only idempotency stores, webhook replay gaps, and missing replay telemetry.
• Extends the report template with a state-changing idempotency and replay evidence table.
• Updates the skill version to 1.1.0.

Validation

• git diff --check
• Markdown fence balance check: 10 balanced
• Verified markers for version 1.1.0, State-Changing Idempotency and Replay Evidence, Idempotency-Key, Duplicate Test Result, and the new retry pitfall

Bounty request

Improver Moderate / $100 if accepted. Payment details can be provided privately after maintainer acceptance.