fix(tasks): make duplicate sourceRef creates idempotent

[lilyshen0722]

Summary

• reconcile the POST /api/v1/tasks/:podId read/create race when Mongo's unique partial (podId, sourceRef) index selects a concurrent winner
• return the winning task as the existing idempotent response (200, alreadyExists: true) instead of a generic 500
• narrow recovery to the sourceRef index via keyPattern / index name and a required follow-up lookup
• preserve real failures: a taskId E11000 is not mislabeled as sourceRef idempotency, even when the request carries a sourceRef
• preserve the pre-check's existing pending-task dedup and completed-task reopen behavior
• rate-limit task creation by hashed auth token (IP fallback), and runtime-validate/materialize request scalars before any Mongo query or write

Why the follow-up lookup is required

E11000 identifies the database winner but does not carry the full task response. The route re-reads by the validated request scope (podId, sourceRef) only after confirming that exact unique index caused the collision. If the row is absent, the original error is rethrown.

Verification

• service regression suite with MongoMemoryServer: 1 suite / 5 tests passed
• core E11000 regression suite against the running Mongo service: 1 suite / 4 tests passed
• backend TypeScript production build: passed
• git diff --check: passed

Targeted backend ESLint is not a valid gate in the current mixed TS/CJS configuration: it cannot parse .ts route files and cannot resolve TS modules imported by JS tests. CI build, Tier-0/Tier-1 tests, and CodeQL remain the executable gates.

Closes #697