Adds direction-aware idempotency and already-friends checks to handleFederatedFriendRequest (after stub hydration, before transaction), plus 6 tests covering authority defense, bare-host normalization, cannot_friend_self, already_friends, same-direction idempotent 200, and opposite-direction 409.