Build and break an idempotent outbox

The outbox turns "send this email" into a row whose primary key is the idempotency key, and a sender that moves each row through pending → sending → sent (or failed). Everything that must not happen twice is guarded by the database: a second enqueue of the same key is a no-op, a lease stops two workers sending the same row, and only a row still in sending can be completed. The decision that matters most is what the sender does with an ambiguous result: it retries, and it passes the outbox key to the provider so a retry of something already accepted is recognised instead of delivered again.