fix(store): unique event IDs on lease/expiry, honest duplicate-ingest signal (S5, S6)

S5: Store.Lease and Store.ExpireLeases both set Event.ID to the task id, so
every TaskLeased/TaskReleased event for a given task collided on ID across
every lease of that task — unsound for ApplyAdvisory or any future
ID-based lookup. Both now call domain.NewID().

S6: Append's TaskCreated dedup path returned nil (success) without
appending anything. main.go's handler then did
`s.Events(0)[len(s.Events(0))-1]` and returned that — an unrelated event —
with 201 Created, and every other Append caller (Gitea poll/webhook, JSONL
ingest) had no way to distinguish "duplicate, as expected" from "genuinely
appended".

Add domain.ErrDuplicate, returned instead of nil on a duplicate
(source, external_id). Add Store.TaskBySource to resolve the
already-ingested task by that same dedup key. Update every caller:
  - main.go's POST /v1/tasks now returns 200 with the existing task on
    ErrDuplicate instead of fabricating a 201 with the wrong event.
  - provider.Gitea.Poll/IngestWebhook and provider.JSONL.Ingest treat
    ErrDuplicate as expected (already-seen issue/line), not a failure —
    without this, Gitea polling would have errored out of its loop on the
    first already-ingested issue in every batch, since Poll previously
    relied on the old nil-on-dup behavior to keep scanning.

TestLeaseAndExpireEventIDsAreUnique and TestTaskBySourceResolvesDuplicate
cover the store-level fixes; TestAppendReplayAndDeduplicate updated for the
new error signal.

AUDIT.md S5, S6.

internal/domain/domain.go

@@ -17,6 +17,11 @@ var ErrConflict = errors.New("task version conflict")
 var ErrNotFound = errors.New("task not found")
 var ErrInvalid = errors.New("invalid event")
 
+// ErrDuplicate is returned by Store.Append for a TaskCreated event whose
+// (source, external_id) pair was already ingested. The caller already has a
+// task for this content; nothing was appended.
+var ErrDuplicate = errors.New("duplicate task ingestion")
+
 // CurrentEventSchema is 2: schema 2 requires every event to declare its
 // authorizing Surface (see ValidateEvent), enforced at the store append
 // boundary. Schema 1 events already on disk replay unchanged — tolerant