Idempotent webhooks, without the pain

Every gateway will eventually send the same webhook twice. The fix is not hoping it will not happen, it is making the second delivery a no-op.

Store a unique event key, wrap the handler in a transaction, and treat the key insert as the lock. Return success for duplicates so the provider stops retrying.

Add a reconciliation job as a safety net. Webhooks are a hint; your ledger is the truth.