Cross-replica payment constraints

Requests have globally unique idempotency keys; six stateless replicas can receive retries; SQL supports unique constraints and transactions; the external payment cannot join the SQL transaction; the design must recover from crashes between durable state and the side effect. Replica-local memory is neither shared nor durable.