Why "bump the balance by $50" is far riskier than it looks, and how an idempotency key turns an ambiguous retry into a safe one.