fix(rest/python): scope idempotency hashes to checkout operations

[WenshuangQuan-TT]

Summary

• include the checkout operation and target resource in idempotency request fingerprints
• reject reuse of an idempotency key for a different checkout instead of replaying another checkout's cached response
• preserve cached responses for exact retries of update, complete, and cancel operations
• add regression coverage for same-request replay and cross-checkout conflicts

Why

Idempotency records are keyed globally, but the previous request hash only covered the request body. The checkout ID lives in the URL for update, complete, and cancel requests, and cancel requests all have the same empty body. Reusing a key for a different checkout could therefore return the first checkout's cached response with HTTP 200 while leaving the requested checkout unchanged.

The request fingerprint now includes the operation, resource ID, and request data. Exact retries still return the cached response, while reusing the key for a different operation or checkout returns 409 IDEMPOTENCY_CONFLICT.

Testing

• .venv/bin/python -m pytest -v (133 passed, 6 subtests passed)
• pre-commit hooks for the changed files
• git diff --check origin/main..HEAD