fix(backend): keep one idempotency cleanup timer across reloads

[woahwhattheheck]

Closes #1942.

The module-local timer guard is reset by hot reload and vi.resetModules(), so repeated imports create extra cleanup intervals and separate in-memory stores. This keeps the store and cleanup handle in one namespaced global state. Any retained clearCleanupInterval() export clears the active timer; a later import may restart one timer. Node timers are unreferenced, while numeric browser handles and timer shims remain supported.

Only the cleanup lifecycle and its focused regression file change. Record fields, TTL behavior and service methods are preserved.

Validation for these unchanged source/test postimages:

• Node 20.20.2, isolated Vitest 2.1.9: the original source passes 1/6 new lifecycle cases; the candidate passes all six plus the 33 unchanged unit cases (39/39).
• Changed production logic: 19/19 statements, 7/7 branches, 1/1 named function covered. Full-module statement coverage is 84.76%; unchanged getdel/incr/expire logic is outside the retained selection.
• Recorded run: https://github.com/woahwhattheheck/bounty-concierge/actions/runs/37201398150
• Complete source and evidence: https://github.com/woahwhattheheck/bounty-concierge/blob/36dc2eba1a3223cce6f7f04e23870f7683950f23/ACCEPTANCE.md

The two published files match the tested blobs exactly: production 4f116f46a536ce09afc640b094c1f19684dddce1, tests 85d4012714e93b7a3dc7fdbdc8d7f6ae33e08c9d. Head 7647ffd83a8a4945ff7424b059af3ece78003058 is one commit ahead of current upstream master 0d847032ef5862806cbb678f0bca93b6be44fb17.

Current project verification also passes all 39 cases on these exact published blobs under Node20.20.2, pnpm9.0.0 and Vitest2.1.9 with the unchanged project configuration/setup and default jsdom29.1.1 environment. V8 whole-module coverage is84.76% statements/lines,100% branches and78.57% functions; the unchanged getdel/incr/expire methods remain outside this focused selection.

Dependency installation exposed an existing base inconsistency: package.json lists Prettier^3.9.6 but pnpm-lock.yaml omits it. For the local focused run only, that unlisted devDependency was temporarily omitted to install the exact existing lock with scripts disabled; package.json was restored before tests. No source or dependency changes were made for validation. Full build/typecheck and hosted upstream CI are not claimed.

[vercel]

@woahwhattheheck is attempting to deploy a commit to the 1nonly's projects Team on Vercel.

A member of the Team first needs to authorize it.