feat: Redis幂等锁 + 关键端点防重复提交

## decorators.py
- 新增 @prevent_double_submit(lock_timeout=5) 装饰器
  Redis key: idem:{user_id}:{path}:{MD5(body)}
  锁存在→409, 不存在→setex→执行业务→delete
  Redis不可用时fail-open降级放行

## purchase.py
- POST /purchase (创建): +@prevent_double_submit
- PATCH /purchase/<id>/approve (审批): +@prevent_double_submit

## outbound.py
- POST /outbound (出库): +@prevent_double_submit

## transactions.py
- POST /borrow/dispatch (借库扣减): +@prevent_double_submit

inventory-backend/app/api/v1/transactions.py

@@ -1,6 +1,6 @@
 from flask import Blueprint, jsonify, request  # .material -> .base refactor checked
 from flask_jwt_extended import jwt_required, get_jwt_identity, get_jwt
-from app.utils.decorators import permission_required, audit_log
+from app.utils.decorators import permission_required, audit_log, prevent_double_submit
 from app.services.auth_service import AuthService
 from app.services.trans_service import TransService
 from app.services.borrow_service import BorrowApprovalService
@@ -308,6 +308,7 @@ def get_borrow_stock_list():
 # --- 执行借库扣减（审批通过后调用）---
 @trans_bp.route('/borrow/dispatch', methods=['POST'])
 @jwt_required()
+@prevent_double_submit(lock_timeout=5)
 @permission_required('op_borrow:operation')
 def dispatch_borrow():
     """