Safe retries with idempotency

Idempotency-Key is optional on POST /uploads. Without it, every prepare request creates a new upload. Once you have an upload ID, retry completion with that ID instead of uploading again. Once you have a review ID, check that review instead of submitting again.

For automatic retries of the prepare request, supply a stable key, such as catalog-1042-v1. Repeating it with the same request fields returns the original upload, or its review ID if already completed, instead of creating duplicate work. If reviewId is returned, skip uploading and retrieve that review.

Changed request fields return 409 idempotency_conflict. Always use a new key when the file changes, even if its name stays the same: without a supplied checksum, the prepare request cannot compare file contents. If a response is lost, retry with the original key first.

Idempotency does not make all management operations retry-safe. For example, do not blindly retry creating or rotating API keys after a network failure.