Fix duplicate retirement submission guard

[boalambo]

Summary

This PR fixes duplicate-retirement submissions in the client by closing the race window between a user click and React state re-render, and by attaching a client-generated idempotency key to each retirement request.

What changed

• Added a ref-based in-flight submission guard in the retirement hook to block duplicate sends before React state updates can disable the UI.
• Generated a client-side idempotency key per submit attempt and forwarded it into the retirement request.
• Disabled the purpose selector, credit selector, and amount controls while a retirement is in flight.
• Added a short cooldown after failed submissions to prevent immediate repeat clicks.
• Preserved the submission lock across remounts by keeping the guard in the shared hook rather than local component-only state.
• Added regression tests covering:
  • rapid double-submit race
  • idempotency key propagation
  • existing success/error flow remains intact

Why

The previous flow allowed a second submission to queue before the disabled state took effect, which could produce duplicate retirement requests. The client also did not send an idempotency key, which prevented the backend from distinguishing a genuine retry from a duplicate user action.

Validation

Verified with:

• npx vitest run "src/components/retirement/InstantRetirementForm.test.tsx" "src/services/retirement.service.test.ts" --reporter=basic

Result:

• 2 test files passed
• 31 tests passed
• exit code 0

Closes #553

[drips-wave]

@boalambo Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits