[Backend][Bug] /api/v1/transactions is missing the idempotency middleware applied to /api/transactions

[Penielka]

Overview

The unversioned mount applies idempotency and the transaction limiter:
app.use('/api/transactions', idempotency(), transactionLimiter, transactionRoutes)
but the versioned mount only applies the limiter:
app.use('/api/v1/transactions', transactionLimiter, transactionRoutes)
The whole point of the idempotency key is to prevent duplicate payment/transaction submissions on retry — a client that retries a timed-out request against /api/v1/transactions can create duplicate transactions.

Evidence

• backend/src/index.ts — the two /transactions mounts

Acceptance Criteria

• Apply idempotency() to the versioned mount as well
• Add a test asserting identical behavior across /api/transactions and /api/v1/transactions

Files to Modify

• backend/src/index.ts

Priority: Medium