MARS-468 follow-up: support-action idempotency ledger for close/reopen + test coverage

MARS-468 audit BLOCK P1/P2 follow-up: close/reopen not idempotency-key-safe across an intervening opposite transition (replayed key can re-flip state; reply/note already safe, emails already dedupe-protected). Fix = consumed-operation-key ledger (small db-mars migration, Class-A) + route rework (coder-mars-cc) + route/transition idempotency + no-reporter-email test coverage (mocked-db harness, scope TBD w/ audit-mars-ca). Route ships fail-closed/inert (SUPPORT_API_KEY unprovisioned) so no live exposure meanwhile - deferred per active token-conservation pause, not urgent.