Void an envelope

Appends envelope.voided (with the optional reason in the event payload). Valid from draft, review, detecting, and in_progress; terminal envelopes (completed, declined, voided, expired) reject with 409. Supports the Idempotency-Key header: a replayed completed key returns the envelope's current graph with the original status code and Idempotency-Replayed: true (never re-executing); an in-flight duplicate is rejected 409; reusing a key with a different request is rejected 422.