Add optional idempotency support for PUT and DELETE methods

[mroderick]

The current implementation only processes POST and PATCH requests through the idempotency middleware, which aligns with the IETF spec noting that these methods are non-idempotent. However, some use cases require exactly-once semantics for PUT and DELETE operations as well.

Proposal

Add an allowedMethods configuration option that defaults to ["POST", "PATCH"] but allows users to include PUT and DELETE for full idempotency protection.

// Default behavior (POST/PATCH only)
app.post(\"/orders\", idempotency({ store }), handler)

// Enable for PUT and DELETE
app.put(
  \"/orders/:id\",
  idempotency({ 
    store, 
    allowedMethods: [\"POST\", \"PUT\", \"PATCH\", \"DELETE\"] 
  }), 
  handler
)

app.delete(
  \"/orders/:id\",
  idempotency({ 
    store, 
    allowedMethods: [\"POST\", \"PUT\", \"PATCH\", \"DELETE\"] 
  }), 
  handler
)

Motivation

1. Exactly-once semantics: Some APIs need guaranteed exactly-once processing for updates/deletes, not just "safe to retry"
2. Idempotency key reuse: Users may want to reuse the same idempotency key across multiple operations
3. Consistency: Provides flexibility for different idempotency requirements

Implementation notes

• Add allowedMethods?: string[] to options
• Default to [\"POST\", \"PATCH\"] for backward compatibility
• Make comparison case-insensitive

Priority

Low (nice-to-have)