Ledger invariants

Ledger.apply(operation_id, account, delta) applies an operation at most once globally.

A successful operation permanently consumes its operation ID.
A rejected overdraft must not consume its operation ID.
A caller may fund the account and retry the same rejected operation.
Balances may never become negative.
Duplicate successful operations return the current balance without applying the delta again.

The current implementation violates the rejected-operation rule.