fix: scope session idempotency dedupe to tenant/user/session boundary

[NeerajCodz]

Motivation

• The in-memory TestMemoryStore::append_session_message deduplicated solely by idempotency_key, allowing a caller in one tenant/user/session to suppress messages in other scopes and causing cross-tenant integrity/availability issues.
• Idempotency semantics should be aligned with session retrieval scoping, i.e., dedupe must consider tenant_id, user_id, and session_id along with idempotency_key.

Description

• Change TestMemoryStore::append_session_message in src/testkit/mod.rs to check the tuple (tenant_id, user_id, session_id, idempotency_key) when deciding whether to treat a message as a duplicate instead of checking only idempotency_key globally.
• Add a regression test session_idempotency_is_scoped_per_tenant_user_session in src/lib.rs that appends two messages with the same idempotency key in different tenant/user/session scopes and asserts both are retained.

Testing

• Ran cargo test -q and all tests passed, including the new session_idempotency_is_scoped_per_tenant_user_session regression test.

---

Codex Task