Fix/165 168 idempotency and race fixes

[whisper011]

Summary

Fixes four correctness bugs around offline sync and auth token refresh on Android and iOS:

• Android: PendingActionSyncWorker can double-submit a check-in or duplicate-create a vault if the process dies mid-sync #165 — PendingActionSyncWorker could double-submit a check-in or duplicate-create a vault
  if the process died between the server accepting the request and the local queue row being
  deleted. Adds a client-generated X-Idempotency-Key (stable across retries, unlike X-Nonce)
  and a synced flag so a row that already succeeded is cleaned up on the next run without
  resubmitting the request or double-counting it in sync diagnostics.
• iOS: CheckInSyncTask/PendingCheckInStore has the same crash-window duplicate-submission risk #166 — iOS CheckInSyncTask/PendingCheckInStore had the same crash-window risk. Adds the
  same idempotency key to PendingCheckIn, threaded through APIClient.checkIn/createVault,
  and makes a corrupted queue file (captured mid-write) surface as lastLoadWasCorrupted instead
  of silently being treated as an empty queue.
• Android: CREATE_VAULT pending actions have no dedupe key, so a double-tap while offline creates two vaults #167 — CREATE_VAULT pending actions had no dedupe key, so a double-tap of "Create Vault"
  while offline queued two identical actions and created two real vaults. Adds an in-flight guard
  (VaultUiState.isCreatingVault) so a second tap can't reach the network/queue while the first
  call is still pending.
• Android: concurrent requests near token expiry trigger a token-refresh race with no mutex #168 — Concurrent requests near token expiry each independently called /auth/refresh,
  with no ordering guarantee on which response won. Adds single-flight protection
  (Mutex + CompletableDeferred) so concurrent callers share one in-flight refresh.

Test plan

• Android: PendingActionSyncWorkerTest, CheckInSyncWorkerTest, VaultViewModelTest,
  ApiClientTest cover idempotency-key resubmission, synced-row dedupe, double-tap
  create-vault guarding, and single-flight token refresh.
• iOS: CheckInSyncTaskTests covers idempotency-key resubmission after a simulated crash
  and corrupt-queue-file detection.
• Build environment here couldn't run the Gradle/Xcode toolchains directly (JDK/toolchain
  mismatch, no Swift toolchain available) — please run the test suites in CI before merging.

Closes #165
Closes #166
Closes #167
Closes #168

[drips-wave]

@whisper011 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits